I have events from one log source which can have several known formats. As an example
10:45 Today is Monday
11:13 The weather is nice
12:00 The weather is cloudy
I can match
each of them via
The weather is %{WORD:weather}
Today is %{WORD:weekday}
I am not yet comfortable with the format of logstash filter
. In order to account for each of these possibilities, should I build something like
if message =~ "The weather is"
{
grok {
"match" => "The weather is %{WORD:weather}"
}
}
if message =~ "Today is"
{
grok {
"match" => "Today is %{WORD:weekday}"
}
}
or is there something more compact? (for instance a list of possible patterns for the events with the associated mapping)