|
|
@@ -18,10 +18,30 @@
|
|
|
# field
|
|
|
# operation
|
|
|
{
|
|
|
- grok {
|
|
|
- dictionaryFiles : ["grok_dictionaries"]
|
|
|
- expressions : {
|
|
|
- ${field['name']}: """${operation['settings']['regexp']}"""
|
|
|
- }
|
|
|
+ if{
|
|
|
+ conditions : [
|
|
|
+ # check if grok will match
|
|
|
+ {
|
|
|
+ grok {
|
|
|
+ dictionaryFiles : ["grok_dictionaries"]
|
|
|
+ expressions : {
|
|
|
+ ${field['name']}: """${operation['settings']['regexp']}"""
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ then : [
|
|
|
+ {
|
|
|
+ grok {
|
|
|
+ dictionaryFiles : ["grok_dictionaries"]
|
|
|
+ expressions : {
|
|
|
+ ${field['name']}: """${operation['settings']['regexp']}"""
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ else : [
|
|
|
+ { logDebug { format : "Grok failed to match: {}", args : ["@{}"] } }
|
|
|
+ ]
|
|
|
}
|
|
|
}
|