Logstash - If %{statement} has "value"

Question

In Logstash, I'm trying to set a condition where if within a file named "cowrie.json", if a new message is received that starts with "login attempt*" - send an email.

This is what I tried:

output {
  if [log][file][path] =~ "cowrie.json" {
  if %{message} =~ "login attempt.*"{
    email {
      to => '[email protected]'
      subject => 'Honeypot Alert'
      body => "Someone interacted with the honeypot!"
      domain => 'mail.xconnect.net'
      port => 25
    }
  }
 }
}

If I remove the second if statement, it works. Does anyone happen to know what I have to replace the second if statement so that it would only apply to entires/messages that start with "login attempt"?

Huge thanks ahead!

Answer 1

Edit: SOLVED:

 if "login attempt" in [message] {

or

 if [message] =~ "^login attempt" {

---