Search code examples
logstashlogstash-grok

How to filter on a field value for Logstash Grok

I'm setting up Logstash to send NGINX log entries to Elasticsearch. I currently have the following Grok pattern set up to match entries:

%{IPORHOST:remoteAddr} (?:-|(%{WORD}.%{WORD})) %{USER:ident} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:method} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:status} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{QS:forwarder}

In this case, the method field is optional.

I'm trying to figure out a way to ignore log entries where method is present and the value is equal to the string HEAD.

Is there any way to do that, or am I SOL?

Solution

  • Use a conditional and drop the event if the [method] field has that value:

    if [method] == "HEAD" { drop {} }

    If there is no [method] field then the string compare will return false and event will not be dropped.