if-else-elif: Conditional expressions

You can use if {}, elif {}, and else {} blocks to configure conditional expressions.

Note that if {} blocks imply the flags(final) option automatically, and are equivalent to log { some condition; flags(final);}.

Conditional expressions’ format

Conditional expressions have two formats:

• Explicit filter expression:

  if (message('foo')) {
      parser { date-parser(); };
  } else {
      ...
  };
  

  This format only uses the filter expression in if(). If if does not contain 'foo', the else branch is taken. The else{} branch can be empty, you can use it to send the message to the default branch.

• Condition embedded in the log path:

  if {
      filter { message('foo')); };
      parser { date-parser(); };
  } else {
      ...
  };
  

  This format considers all filters and all parsers as the condition, combined. If the message contains 'foo' and the date-parser() fails, the else branch is taken. Similarly, if the message does not contain 'foo', the else branch is taken.

Using the if {} and else {} blocks in your configuration

You can copy-paste the following example and use it as a template for using the if {} and else {} blocks in your configuration.

log{
    source { example-msg-generator(num(1) template("...,STRING-TO-MATCH,..."));};
    source { example-msg-generator(num(1) template("...,NO-MATCH,..."));};

    if (message("STRING-TO-MATCH")) {
        destination { file(/dev/stdout template("matched: $MSG\n") persist-name("1")); };
    }

    else {
    destination { file(/dev/stdout template("unmatched: $MSG\n") persist-name("2")); };
    };
};

The configuration results in the following console printout:

matched: ...,STRING-TO-MATCH,...
unmatched: ...,NO-MATCH,...

An alternative, less straightforward way to implement conditional evaluation is to use junctions. For details on junctions and channels, see Junctions and channels.