Logstash + nginx: Fields wont be added - logstash

Question

I'am going to Setup my own ELK Server to centralize logging. So far so good.
I Setup docker-compose.yml to run the ELK stack and another docker-compose.yml to run filebeat, wich will watch logfiles, add env + tags and sent to logstash. The parsing should be made in logstash.
filebeat.yml
name: xyz
fields:
env: xyz
output.logstash:
hosts: ["xyz:5044"]
filebeat.prospectors:
- input_type: log
fields:
app_id: default
type: nginx-access
tags:
- nginx
- access
paths:
- /logs/nginx/access.log*
- input_type: log
fields:
app_id: default
type: nginx-error
tags:
- nginx
- error
paths:
- /logs/nginx/error.log*
and here's the logstash.yml
input {
beats {
port => 5044
}
}
filter {
if ["nginx"] in [tags] and ["access"] in [tags] {
grok {
patterns_dir => "/etc/logstash/patterns"
match => { "message" => "%{NGINXACCESS}" }
}
date {
match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
}
}
}
output {
elasticsearch {
hosts => ["elasticsearch:9200"]
}
stdout { codec => rubydebug }
}
The nginx-pattern is here
NGUSERNAME [a-zA-Z\.\#\-\+_%]+
NGUSER %{NGUSERNAME}
NGINXACCESS %{IPORHOST:clientip} %{NGUSER:indent} %{NGUSER:agent} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{URIPATHPARAM:request}(?: HTTP/%{NUMBER:httpversion})?|)\" %{NUMBER:answer} (?:%{NUMBER:byte}|-) (?:\"(?:%{URI:referrer}|-))\" (?:%{QS:referree}) %{QS:agent}
I tested the Expression on grokconstructor.appspot.com and it hits.
Here's a demo line:
127.0.0.1 - - [11/May/2017:13:49:31 +0200] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586" "-"
But no fields where added
I think maybe my "if" is wrong, but I tried several alternatives... nothing helped.
Any idea?

Answer 1

I will start by removing the if, then adding the conditions one by one. That is start with
["nginx"] in [tags]
and if that works, then go in for
["nginx"] in [tags] and ["access"] in [tags]
Alternatively you could try using
"nginx" in [tags] and "access" in [tags]
UPDATE:
To used fields.type = nginx-access, try
"nginx-access" in [fields][type]