||语法问题

[Gunara-Godofdarkness]

filters:
    - Grok:
        src: message
        match:
            - '^\[(?P<time_local>.*)\] \[(?P<host>.*)\] \[(?P<scheme>.*)\] \[(?P<request_method>.*)\] \[(?P<request_uri>.*)\] \[(?P<request_body>.*)\] \[(?P<status>.*)\] \[(?P<body_bytes_sent>.*)\] \[(?P<request_length>.*)\] \[(?P<http_referer>.*)\] \[(?P<http_user_agent>.*)\] \[(?P<http_x_forwarded_for>.*)\] \[(?P<http_cookie>.*)\] \[(?P<upstream_response_time>.*)\] \[(?P<request_time>.*)\] \[(?P<upstream_addr>.*)\] \[(?P<server_addr>.*)\]$'
        remove_fields: ['message']
    - Date:
        location: 'Asia/Shanghai'
        src: time_local
        target: timestamp
        formats:
            - 'RFC3339'
        remove_fields: ["time_local"]
    - Drop:
        if:
          - '!EQ($.host,"wlya.xxx.cn") || !EQ($.host,"pc3.xxx.cn")'        #这行配置没生效,有什么问题吗,如果写一个条件是可以的,||好像不行

[Gunara-Godofdarkness]

- Drop:
    if:
      - '!(EQ($.host,"wlya.xxx.cn") || EQ($.host,"pc3.xxx.cn"))'    
      可以这样写

[childe]

不好意思，回复晚了。

这个语法本身没问题，但是你这个逻辑有问题吧。 host 这个字段不可能即等于 A 又等于 B，所以这个条件永远不能满足。