[elk@zjtest7-frontend config]$ cat stdin04.conf

input {

    stdin {

    }

}

filter {

  # drop sleep events

  grok {

    match => { "message" => "SELECT aaa" }

    add_tag => [ "sleep_aaa" ]

    #tag_on_failure => [] # prevent default _grokparsefailure tag on real records

  }

  grok {

    match => { "message" => "SELECT bbb" }

    add_tag => [ "sleep_bbb" ]

  }

  }

output {

if "sleep_aaa" in [tags]{

 stdout {

  codec=>rubydebug{}

   }

}

 else if "sleep_bbb" in [tags]{

 stdout {

  codec=>json

   }

}

}

[elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf

Settings: Default pipeline workers: 1

Pipeline main started

SELECT bbb

{"message":"SELECT bbb","@version":"1","@timestamp":"2016-09-15T10:33:12.170Z","host":"0.0.0.0","tags":["_grokparsefailure","sleep_bbb"]}

此时出现了默认的"tags":["_grokparsefailure","sleep_bbb"]

/************************************************************

[elk@zjtest7-frontend config]$ cat stdin04.conf

input {

    stdin {

    }

}

filter {

  # drop sleep events

  grok {

    match => { "message" => "SELECT aaa" }

    add_tag => [ "sleep_aaa" ]

    tag_on_failure => [] # prevent default _grokparsefailure tag on real records

  }

  grok {

    match => { "message" => "SELECT bbb" }

    add_tag => [ "sleep_bbb" ]

  }

  }

output {

if "sleep_aaa" in [tags]{

 stdout {

  codec=>rubydebug{}

   }

}

 else if "sleep_bbb" in [tags]{

 stdout {

  codec=>json

   }

}

}

a

[elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf

Settings: Default pipeline workers: 1

Pipeline main started

SELECT bbb

{"message":"SELECT bbb","@version":"1","@timestamp":"2016-09-15T10:34:39.194Z","host":"0.0.0.0","tags":["sleep_bbb"]}