Logstash config, "if string contains..."

Question

So, let's assume that I have a portion of a log line that looks something like this:

GET /restAPI/callMethod1/8675309

The GET matches a http method, and get's extracted, the remainder matches a URI, and also gets extracted. Now in the logstash config let's assume that I wanted to do something like this...

if [METHOD] == "GET" {
    if [URI] (CONTAINS <--Is there a way to do this?) =="restAPI/callMethod1"{
        ....

Is there some way to do this? If so how would I go about doing that?

Thanks

Job

Answer 1

You can achieve it simply by using the =~ (regexp) operator like this (see conditionals):

if [METHOD] == "GET" {
  if [URI] =~ /restAPI\/callMethod1/ {
     ...

Pyrone