如何在弹性搜索中从logstash索引自定义字段？

Question

Below is my logstash config file.

input {
  stdin{}
}  

filter {
  mutate {
    if(message =~ "*FF"){
    add_field => { "vname" => "olive" }
    }
    else{
    add_field => { "vname" => "popeye" }
    }
  }
}


output {
   stdout { codec => rubydebug }
   elasticsearch { 
            hosts => ["localhost:9200"]
            index => "servererrors"
        }
}

Below image shows my kibana output.

http://i.stack.imgur.com/pJANQ.png

The problem is i need to filter "olive" alone. As you can see a filter in and filter off for host field but it is not available for vname field.

Filter Not available

Below is my mapping file response for vname

"vname": {
            "type": "string",
            "store": true
          },

I am confused with templates and mappings. Please explain clearly.

Answer 1

Add "if" statement and grok plugin. You need parse this events separately. If you show your events i can help you with filter.

Answer 2

Based on your recent edit, it looks like you're just a little backwards on the syntax:

filter {
    if [myField] == "myValue" {
        mutate {
            add_field => { ... }
        }
    }
    else {
        mutate {
            add_field => { ... }
        }
    }
}