title: Logstash config, “if message contains…”
body: <p>So, let's assume that I have a portion of a log line that looks something like this:</p>
  
  <pre><code>Dec 11 13:59:17 172.00.1.00 NPF_OLT_LAB05: clear service affecting Alarm for ONT "100002" at 2019/12/11 13:59:17.28: "ONT Dying Gasp"
  </code></pre>
  
  <p>And I have to create a filter that does something like this</p>
  
  <pre><code>filter {
    if ([message]) =~ "NPF_OLT_LAB05"{
     grok{
        match =&gt; { "message" =&gt; "%{SYSLOGBASE} %{WORD:Alarm_Severity} %{DATA:Message} %{QS:ONT_ID} %{DATA:Time} %{QS:ONT_Message}" }
     }
   }
  }
  </code></pre>
  
  <p>Is this possible?</p>