title: logstash if statement within grok statement
body: <p>I'm creating a logstash grok filter to pull events out of a backup server, and I want to be able to test a field for a pattern, and if it matches the pattern, further process that field and pull out additional information.</p>
  
  <p>To that end I'm embedding an <code>if</code> statement within the <code>grok</code> statement itself. This is causing the test to fail with <code>Error: Expected one of #, =&gt;</code> right after the <code>if</code>. </p>
  
  <p>This is the filter statement:</p>
  
  <pre><code>filter {
      grok {
          patterns_dir =&gt; "./patterns"
          # NetWorker logfiles have some unusual fields that include undocumented engineering codes and what not
          # time is in 12h format (ugh) so custom patterns need to be used.
          match =&gt; [ "message", "%{NUMBER:engcode1} %{DATESTAMP_12H:timestamp}  %{NUMBER:engcode2} %{NUMBER:engcode3} %{NUMBER:engcode4} %{NUMBER:ppid} %{NUMBER:pid} %{NUMBER:engcode5} %{WORD:processhost} %{WORD:processname} %{GREEDYDATA:daemon_message}" ]
          # attempt to find completed savesets and pull that info from the daemon_message field
          if [daemon_message] =~ /done\ saving\ to\ pool/  { 
              grok {
                  match =&gt; [ "daemon_message", "%{WORD:savehost}\:%{WORD:saveset} done saving to pool \'%{WORD:pool}\' \(%{WORD:volume}\) %{WORD:saveset_size}" ]
              }
          }
      }
      date {
          # This is requred to set the time from the logline to the timestamp and not have it create it's own.
          # Note the use of the trailing 'a' to denote AM or PM. 
          match =&gt; ["timestamp", "MM/dd/yyyy HH:mm:ss a"]
      } 
  }
  </code></pre>
  
  <p>This block fails with the following:</p>
  
  <pre><code>$ /opt/logstash/bin/logstash -f ./networker_daemonlog.conf --configtest
  Error: Expected one of #, =&gt; at line 12, column 12 (byte 929) after # Basic dumb simple networker daemon log grok filter for the NetWorker daemon.log 
  # no smarts to this and not really pulling any useful info from the files (yet)
  filter {
      grok {
  ... lines deleted ...
          # attempt to find completed savesets and pull that info from the daemon_message field
          if 
  </code></pre>
  
  <p>I'm new to logstash, and I realise that using a conditional within the <code>grok</code> statement may not be possible, but I'd prefer doing conditional processing this way to additional <code>match</code> lines as this would leave the daemon_message field intact for other uses while pulling out the data I want.</p>
  
  <p>ETA: I should also point out that totally removing the <code>if</code> statement allows the configtest to pass and the filter to parse logs.</p>
  
  <p>Thanks in advance...</p>