title: How to use IF ELSE condition in grok pattern in logstash
body: <p>I have web and API log combined and I want to save it separately in elasticsearch. So I want to write one pattern if the request is for API then if past should execute, the request is web then else part of the log should be executed.</p>
  
  <p>Below are few web and API logs.</p>
  
  <pre><code>00:06:27,778 INFO  [stdout] (ajp--0.0.0.0-8009-38) 00:06:27.777 [ajp--0.0.0.0-8009-38] INFO  c.r.s.web.rest.WidgetController - Method getWidgetDetails() started to get widget details.
  00:06:27,783 INFO  [stdout] (ajp--0.0.0.0-8009-38) ---&gt; HTTP GET http://api.survey.me/v1/getwidgetdetails?profileName=jeremy-steffens&amp;profileLevel=INDIVIDUAL&amp;companyProfileName=premier-nationwide-lending&amp;hideHistory=true
  00:06:27,817 INFO  [stdout] (ajp--0.0.0.0-8009-38) &lt;--- HTTP 200 http://api.survey.me/v1/getwidgetdetails?profileName=jeremy-steffens&amp;profileLevel=INDIVIDUAL&amp;companyProfileName=premier-nationwide-lending&amp;hideHistory=true (29ms)
  00:06:27,822 INFO  [stdout] (ajp--0.0.0.0-8009-38) 00:06:27.822 [ajp--0.0.0.0-8009-38] INFO  c.r.s.web.rest.WidgetController - Method getWidgetDetails() finished.
  00:06:27,899 INFO  [stdout] (ajp--0.0.0.0-8009-40) 00:06:27.899 [ajp--0.0.0.0-8009-40] INFO  c.r.s.web.controller.LoginController - Inside initLoginPage() of LoginController
  </code></pre>
  
  <p>I tried to write condition but it's not working. It's working only up to thread name. After thread I have multiple type log so not able to write witout if condition.</p>
  
  <pre><code>(?:%{TIME:CREATED_ON})(?:%{SPACE})%{WORD:LEVEL}%{SPACE}\[%{NOTSPACE}\]%{SPACE}\(%{NOTSPACE:THREAD}\)
  </code></pre>
  
  <p>Can anybody give me suggestion?</p>