If clause to filter ciscoasa events without source IP

[arnux72]

Hi.
I'm using the alerting via mail realized by configuring an additional output for email at the logstash.conf file. The output via mail's filtered via an if clause searching for a tag (as mentioned before at another discussions).
Due to a running tpot, the system reports a ciscoasa attack without a source IP each x-days as you know.

So I want to expand my if cause with the check of empty IP source in expectation to report just real attacks on ports by adding "and not" or something like that. I'm sorry, I'm not a programmer, just able to read some codes basically.

I did realize the output via email with following if clause successfully:

if "shouldmail" in [tags] {
email {

My tryout to avoid sending mails at the mentioned ciscoasa events without source ip is by expanding the if clause in this way:

if "shouldmail" in [tags] and "src_ip" != "" {
email {

But it won't work.
Do you have an idea for the correct syntax?

Thanks a lot for your kind asistance.

[Ganesh-403]

@arnux72
Your original condition:

if "shouldmail" in [tags] and "src_ip" != "" {

doesn't work because "src_ip" is being treated as a literal string, not as the value of the src_ip field.

In Logstash conditionals, fields must be referenced using square brackets, for example:

[src_ip]

The Logstash conditional syntax supports field references, comparison operators (==, !=), and boolean operators such as and and or. :contentReference[oaicite:0]{index=0}

If you want to send emails only when the shouldmail tag exists and src_ip is present and not empty, you can do something like:

output {
  if "shouldmail" in [tags] and [src_ip] and [src_ip] != "" {
    email {
      ...
    }
  }
}

Or, if your Cisco ASA events are missing the field entirely, you can simply test for its existence:

output {
  if "shouldmail" in [tags] and [src_ip] {
    email {
      ...
    }
  }
}

Logstash treats if [src_ip] as false when the field doesn't exist or is null. :contentReference[oaicite:1]{index=1}

If you're specifically trying to suppress the periodic Cisco ASA event, another good way to debug is to inspect one of those events in Kibana (or with a stdout { codec => rubydebug } output) and verify:

• Is src_ip completely missing?
• Is it present but empty ("")?
• Or does it contain another placeholder value (e.g. "0.0.0.0" or "-")?

The correct conditional depends on how that event is actually represented.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.