title: Logstash grok chain conditional filters
body: <p>I'm trying to create a grok pattern for a mixed log. This is my first time creating a conditional chain and I keep getting syntax errors:</p>
  
  <pre><code>opt/logstash/bin/logstash -f /opt/logstash/conf.d/sip-parser.conf --    configtest
  Error: Expected one of #, in, not , ==, !=, &lt;=, &gt;=, &lt;, &gt;, =~, !~, and, or,    xor, nand, { at line 27, column 14 (byte 580) after filter {
      # separate soap calls from responses
              grok {
                      match =&gt; { "message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}"}
                      }
                      if [type]
  </code></pre>
  
  <p>My configfile:</p>
  
  <pre><code>input {
      file{
              path =&gt; "/home/steven/sip.log"
              start_position =&gt; beginning
              # logstash stores the lastrun=&gt; so we trick it
              sincedb_path =&gt; "/dev/null"
  
              #if logentry does not start with date it's part of previous entry
              codec =&gt;  multiline {
              pattern =&gt; "\[^%{TIMESTAMP_ISO8601:logdate}\]"
              negate =&gt; "true"
              what =&gt; "previous"
      }
  
              }
      }
  
  filter {
              grok {
  
                      match =&gt; { "message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}"}
                      }
                      # separate soap calls from responses
                      if ([type] ~= /AbstractLoggingInterceptor:\ Inbound Message$/) {
                              grok {
                                      match =&gt; { "message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}\n----------------------------\n%{GREEDYDATA:id}\n%{GREEDYDATA:responsecode}\n%{GREEDYDATA:encoding}\n%{GREEDYDATA:contenttype}\n%{GREEDYDATA:headers}\n%{GREEDYDATA:payload}\n--------------------------------------"}
                              }
                      }
                      else if ([type] ~= /AbstractLoggingInterceptor:\ Outbound Message$/) {
                              grok {
                                      match =&gt; {"message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}\n---------------------------\n%{GREEDYDATA:id}\n%{GREEDYDATA:responsecode}\n%{GREEDYDATA:encoding}\n%{GREEDYDATA:contenttype}\n%{GREEDYDATA:headers}\n%{GREEDYDATA:payload}\n--------------------------------------"}
                              }
                      }
                      else {
                              grok {
                                      match =&gt; {"message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}"}
                              }
                      }
  
              }
  
  output {
      #elasticsearch {}
      stdout{}
  }
  </code></pre>
  
  <p>The logfile I'm trying to parse can be found here: <a href="http://pastebin.com/afbNfmjW" rel="nofollow">http://pastebin.com/afbNfmjW</a>
  The individual grok patterns for each different type of entry have  been tested in <a href="http://grokdebug.herokuapp.com/" rel="nofollow">http://grokdebug.herokuapp.com/</a> but I can't chain these together. What am I doing wrong?</p>