如果语句不适用于 grok 过滤器 logstash

Question

Problem

I'm trying to learn logstash and parsing grok with conditional statement. The logs succesfully parsed outside if statement, but nothing parsed inside the statement. Seems like grok not reading the expression.

target

[2020-01-09 08:32:46] VERBOSE[18962][C-0000ceae] pbx.c: Executing [s@macro-dialout-trunk:26] NoOp("PJSIP/3513-0001108e", "Dial failed for some reason with DIALSTATUS = BUSY and HANGUPCAUSE = 19") in new stack

filter
{
    grok
    {
        match =>
        {
            "message" => "\[%{TIMESTAMP_ISO8601:log_timestamp}\] +(?<log_level>(?i)(?:debug|notice|warning|error|verbose|dtmf|fax|security)(?-i))\[%{INT:thread_id}\](?:\[%{DATA:call_thread_id}\])? %{DATA:module_name}\: %{WORD:action}\s\[%{DATA:TARGET}@%{DATA:dialplan_context}:%{DATA:dialplan_priority}\]\s%{GREEDYDATA:log_message}"
        }
        add_field => ["receiver_timestamp", "%{@timestamp}"]
        add_field => ["process_name","asterisk_failed"]
    }
    if [action] == "Executing" and [dialplan_priority]=="1"{
        grok
        {
            match =>
            {
                "log_message"=>"%{DATA:asterisk_app}\(\"%{DATA:protocol}\/%{DATA:EXT}\-%{DATA:channel}\"\,\s\"%{DATA:problem1}\-\s%{DATA:problem2}\"\)\s%{GREEDYDATA:all}"
            }
        }
    }
    if [action] == "Executing" and [dialplan_priority]=="26"{
        grok
        {
            match =>
            {
                "log_message"=>"%{DATA:asterisk_app}\(\"%{DATA:protocol}\/%{DATA:EXT}\-%{DATA:channel}\"\,\s\"%{DATA:problem1}\sand\s%{DATA:problem2}\"\)\s%{GREEDYDATA:all}"
            }
        }
    }
}

I've tested (by myself) my grok filter and it works well. Are there some stuff that needed to be imported so i can use conditional expression?

Answer 1

尝试改变条件，如：

if "Executing" in [action] { logic }

Answer 2

尝试将条件更改为

 if [action] =~ "Executing" and [dialplan_priority] =~"1"{ logic }