[elk@zjtest7-frontend config]$ cat stdin04.conf

input {

    stdin {

    }

}

filter {

  # drop sleep events

  grok {

    match => [ "message" , "(error|ERROR)" ]

    add_tag => [ "sleep_aaa" ]

    tag_on_failure => [] # prevent default _grokparsefailure tag on real records

  }

  grok {

    match => { "message" => "SELECT bbb" }

    add_tag => [ "sleep_bbb" ]

  }

  }

output {

if "sleep_aaa" in [tags]{

 stdout {

  codec=>rubydebug{}

   }

}

 else if "sleep_bbb" in [tags]{

 stdout {

  codec=>json

   }

}

}

[elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf --configtest

Configuration OK

[elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf

Settings: Default pipeline workers: 1

Pipeline main started

error

{

       "message" => "error",

      "@version" => "1",

    "@timestamp" => "2016-09-16T03:13:54.288Z",

          "host" => "0.0.0.0",

          "tags" => [

        [0] "sleep_aaa",

        [1] "_grokparsefailure"

    ]

}

error414

{

       "message" => "error414",

      "@version" => "1",

    "@timestamp" => "2016-09-16T03:14:02.496Z",

          "host" => "0.0.0.0",

          "tags" => [

        [0] "sleep_aaa",

        [1] "_grokparsefailure"

    ]

}

SELECT bbb

{"message":"SELECT bbb","@version":"1","@timestamp":"2016-09-16T03:14:19.360Z","host":"0.0.0.0","tags":["sleep_bbb"]}

SELECT bbb3124234

{"message":"SELECT bbb3124234","@version":"1","@timestamp":"2016-09-16T03:14:26.959Z","host":"0.0.0.0","tags":["sleep_bbb"]}xvxv

vvvv