title: logstash grok - how to do conditional pattern matching?
body: <p>I have these three log lines in the same log file:</p>
  
  <pre><code>INFO [2015-08-27 18:46:14,279] ({qtp243745864-44} NotebookServer.java[onMessage]:101) - RECEIVE &lt;&lt; RUN_PARAGRAPH
  INFO [2015-08-27 18:46:14,322] ({qtp243745864-44} NotebookServer.java[broadcast]:253) - SEND &gt;&gt; NOTE
  INFO [2015-08-27 18:46:16,809] ({pool-1-thread-2} RemoteInterpreter.java[init]:144) - Create remote interpreter org.apache.zeppelin.markdown.Markdown
  </code></pre>
  
  <p>I want to pars them using grok but failing to get the right fields:
  1) how to pars the data within the brackets?
  2) the last part of the log line is either (CMD direction cmd_data) or (cmd info)
  in the example:</p>
  
  <pre><code>cmd=Receive or SEND
  cmd_direction=&lt;&lt; or &gt;&gt;
  cmd_data=RUN_PARAGRAPH or NOTE
  </code></pre>
  
  <p>But the last line is CMD info which does not correspond to the same format.</p>
  
  <p>I am trying to find the right rule that will match the first and second but not the third.
  end result should be or (cmd + cmd_data) or (cmd_info) fields
  Any help?</p>