Logstash grok chain conditional filters
<p>I'm trying to create a grok pattern for a mixed log. This is my first time creating a conditional chain and I keep getting syntax errors:</p>

<pre><code>opt/logstash/bin/logstash -f /opt/logstash/conf.d/sip-parser.conf --    configtest
Error: Expected one of #, in, not , ==, !=, &lt;=, &gt;=, &lt;, &gt;, =~, !~, and, or,    xor, nand, { at line 27, column 14 (byte 580) after filter {
    # separate soap calls from responses
            grok {
                    match =&gt; { "message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}"}
                    }
                    if [type]
</code></pre>

<p>My configfile:</p>

<pre><code>input {
    file{
            path =&gt; "/home/steven/sip.log"
            start_position =&gt; beginning
            # logstash stores the lastrun=&gt; so we trick it
            sincedb_path =&gt; "/dev/null"

            #if logentry does not start with date it's part of previous entry
            codec =&gt;  multiline {
            pattern =&gt; "\[^%{TIMESTAMP_ISO8601:logdate}\]"
            negate =&gt; "true"
            what =&gt; "previous"
    }

            }
    }

filter {
            grok {

                    match =&gt; { "message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}"}
                    }
                    # separate soap calls from responses
                    if ([type] ~= /AbstractLoggingInterceptor:\ Inbound Message$/) {
                            grok {
                                    match =&gt; { "message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}\n----------------------------\n%{GREEDYDATA:id}\n%{GREEDYDATA:responsecode}\n%{GREEDYDATA:encoding}\n%{GREEDYDATA:contenttype}\n%{GREEDYDATA:headers}\n%{GREEDYDATA:payload}\n--------------------------------------"}
                            }
                    }
                    else if ([type] ~= /AbstractLoggingInterceptor:\ Outbound Message$/) {
                            grok {
                                    match =&gt; {"message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}\n---------------------------\n%{GREEDYDATA:id}\n%{GREEDYDATA:responsecode}\n%{GREEDYDATA:encoding}\n%{GREEDYDATA:contenttype}\n%{GREEDYDATA:headers}\n%{GREEDYDATA:payload}\n--------------------------------------"}
                            }
                    }
                    else {
                            grok {
                                    match =&gt; {"message" =&gt; "\[%{TIMESTAMP_ISO8601:logdate}  \] %{LOGLEVEL:level}   %{GREEDYDATA:type}"}
                            }
                    }

            }

output {
    #elasticsearch {}
    stdout{}
}
</code></pre>

<p>The logfile I'm trying to parse can be found here: <a href="http://pastebin.com/afbNfmjW" rel="nofollow">http://pastebin.com/afbNfmjW</a>
The individual grok patterns for each different type of entry have  been tested in <a href="http://grokdebug.herokuapp.com/" rel="nofollow">http://grokdebug.herokuapp.com/</a> but I can't chain these together. What am I doing wrong?</p>