Parse JSON message in Logstash

The == compares simple string and case sensitive, so "jenkins" will not match as your data shows ("buildHost": "Jenkins",):

if[data][buildHost]== "jenkins"

But following does:

if[data][buildHost]== "Jenkins"

If you need match both, you can either use || or regex =~.

The grok is a filter to parse message with regex pattern. You can test your regex pattern with

CodeHunter