Problem
I'm trying to learn logstash and parsing grok with conditional statement. The logs succesfully parsed outside if statement, but nothing parsed inside the statement. Seems like grok not reading the expression.
target
[2020-01-09 08:32:46] VERBOSE[18962][C-0000ceae] pbx.c: Executing [s@macro-dialout-trunk:26] NoOp("PJSIP/3513-0001108e", "Dial failed for some reason with DIALSTATUS = BUSY and HANGUPCAUSE = 19") in new stack
filter
{
grok
{
match =>
{
"message" => "\[%{TIMESTAMP_ISO8601:log_timestamp}\] +(?<log_level>(?i)(?:debug|notice|warning|error|verbose|dtmf|fax|security)(?-i))\[%{INT:thread_id}\](?:\[%{DATA:call_thread_id}\])? %{DATA:module_name}\: %{WORD:action}\s\[%{DATA:TARGET}@%{DATA:dialplan_context}:%{DATA:dialplan_priority}\]\s%{GREEDYDATA:log_message}"
}
add_field => ["receiver_timestamp", "%{@timestamp}"]
add_field => ["process_name","asterisk_failed"]
}
if [action] == "Executing" and [dialplan_priority]=="1"{
grok
{
match =>
{
"log_message"=>"%{DATA:asterisk_app}\(\"%{DATA:protocol}\/%{DATA:EXT}\-%{DATA:channel}\"\,\s\"%{DATA:problem1}\-\s%{DATA:problem2}\"\)\s%{GREEDYDATA:all}"
}
}
}
if [action] == "Executing" and [dialplan_priority]=="26"{
grok
{
match =>
{
"log_message"=>"%{DATA:asterisk_app}\(\"%{DATA:protocol}\/%{DATA:EXT}\-%{DATA:channel}\"\,\s\"%{DATA:problem1}\sand\s%{DATA:problem2}\"\)\s%{GREEDYDATA:all}"
}
}
}
}
I've tested (by myself) my grok filter and it works well. Are there some stuff that needed to be imported so i can use conditional expression?
