如果语句不工作于grok筛选器日志存储

Question

问题

我正在尝试学习logstash和用条件语句解析grok。这些日志成功地在if语句之外进行了解析，但在语句中没有进行任何解析。好像没读过这句话。

目标

2020-01-09 :32:46 VERBOSE18962 pbx.c:在新堆栈中执行s@宏拨号-主干:26 NoOp("PJSIP/3513-0001108e"，“拨号失败，DIALSTATUS =繁忙和HANGUPCAUSE = 19")

filter
{
    grok
    {
        match =>
        {
            "message" => "\[%{TIMESTAMP_ISO8601:log_timestamp}\] +(?<log_level>(?i)(?:debug|notice|warning|error|verbose|dtmf|fax|security)(?-i))\[%{INT:thread_id}\](?:\[%{DATA:call_thread_id}\])? %{DATA:module_name}\: %{WORD:action}\s\[%{DATA:TARGET}@%{DATA:dialplan_context}:%{DATA:dialplan_priority}\]\s%{GREEDYDATA:log_message}"
        }
        add_field => ["receiver_timestamp", "%{@timestamp}"]
        add_field => ["process_name","asterisk_failed"]
    }
    if [action] == "Executing" and [dialplan_priority]=="1"{
        grok
        {
            match =>
            {
                "log_message"=>"%{DATA:asterisk_app}\(\"%{DATA:protocol}\/%{DATA:EXT}\-%{DATA:channel}\"\,\s\"%{DATA:problem1}\-\s%{DATA:problem2}\"\)\s%{GREEDYDATA:all}"
            }
        }
    }
    if [action] == "Executing" and [dialplan_priority]=="26"{
        grok
        {
            match =>
            {
                "log_message"=>"%{DATA:asterisk_app}\(\"%{DATA:protocol}\/%{DATA:EXT}\-%{DATA:channel}\"\,\s\"%{DATA:problem1}\sand\s%{DATA:problem2}\"\)\s%{GREEDYDATA:all}"
            }
        }
    }
}

我(自己)测试了我的抽签过滤器，它运行得很好。是否有一些东西需要导入，以便我可以使用条件表达式？

Answer 1

试图改变这种情况，例如：

if "Executing" in [action] { logic }

Answer 2

尝试将条件更改为

 if [action] =~ "Executing" and [dialplan_priority] =~"1"{ logic }