logstash grok match 对等于号，和中括号做筛选

input {
   syslog{
    port=>514
   }
}
filter {
     grok{
         match=>{
             "message"=>"(?<AAAAFENG>(?<=TYPE=\[Sys)(.{1}))"
          }     
     }
     if[AAAAFENG]=="1"{
         mutate {
            add_field => { "learner_type" => "course" }
            update=>{"AAAAFENG"=>‘SysLOG‘}
        }
     }
}
output {
    stdout{
    codec => rubydebug  
    }
}