mirror of
https://github.com/elastic/logstash.git
synced 2025-04-23 22:27:21 -04:00
Fixed wording for clearer documentation, replaced filter with output
for more realistic example. Conflicts: docs/configuration.md (Cherry-pick from #977)
This commit is contained in:
parent
d731bf4bbd
commit
8ae0fcf3c7
1 changed files with 31 additions and 0 deletions
|
@ -255,6 +255,37 @@ You can also do multiple expressions in a single condition:
|
|||
}
|
||||
}
|
||||
|
||||
Here are some examples for testing with the in conditional:
|
||||
|
||||
filter {
|
||||
if [foo] in [foobar] {
|
||||
mutate { add_tag => "field in field" }
|
||||
}
|
||||
if [foo] in "foo" {
|
||||
mutate { add_tag => "field in string" }
|
||||
}
|
||||
if "hello" in [greeting] {
|
||||
mutate { add_tag => "string in field" }
|
||||
}
|
||||
if [foo] in ["hello", "world", "foo"] {
|
||||
mutate { add_tag => "field in list" }
|
||||
}
|
||||
if [missing] in [alsomissing] {
|
||||
mutate { add_tag => "shouldnotexist" }
|
||||
}
|
||||
if !("foo" in ["hello", "world"]) {
|
||||
mutate { add_tag => "shouldexist" }
|
||||
}
|
||||
}
|
||||
|
||||
Or, to test if grok was successful:
|
||||
|
||||
output {
|
||||
if "_grokparsefailure" not in [tags] {
|
||||
elasticsearch { ... }
|
||||
}
|
||||
}
|
||||
|
||||
## Further Reading
|
||||
|
||||
For more information, see [the plugin docs index](index)
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue