How can I have logstash drop all events that do not match a group of regular expressions?

Question

I'm trying to match event messages with several regular expressions. I was going for the use of grep filter, but its deprecated so I'm trying for the drop with negation.

The functionality I'm looking for is to have all events dropped unless the message matches several regular expressions.

The filter bellow does not work, but tested individually both expressions work fine. What am I missing?

filter {    
    if ([message] !~ ' \[critical\]:  ' or [message] !~ '\[crit\]: ') {
        drop { }
    }
}

Answer 1

I was reading a bit more and went along with painting the events with grok by adding a tag and dropping them in the end, if the tag was not there:

filter {
  grok {
    add_tag => [ "valid" ]
    match => [ 
      "message", ".+ \[critical\]: ?(.+)",
      "message", ".+ \[crit\]: ?(.+) ",
      "message", '.+ (Deadlock found.+) ',
      "message", "(.+: Could not record email: .+) "
    ]
  }

  if "valid" not in [tags] {            
    drop { }
  }

  mutate {
    remove_tag => [ "valid" ]
  }
}