How to filter on a field value for Logstash Grok

Question

I'm setting up Logstash to send NGINX log entries to Elasticsearch. I currently have the following Grok pattern set up to match entries:

%{IPORHOST:remoteAddr} (?:-|(%{WORD}.%{WORD})) %{USER:ident} [%{HTTPDATE:timestamp}] "(?:%{WORD:method} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:status} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{QS:forwarder}

In this case, the method field is optional.

I'm trying to figure out a way to ignore log entries where method is present and the value is equal to the string HEAD.

Is there any way to do that, or am I SOL?

Answer 1

Use a conditional and drop the event if the [method] field has that value:

if [method] == "HEAD" { drop {} }

If there is no [method] field then the string compare will return false and event will not be dropped.