# Auditbeat Conditional Processing if then else
**URL:** https://discuss.elastic.co/t/auditbeat-conditional-processing-if-then-else/295697
**Category:** Beats
**Tags:** auditbeat
**Created:** [January 28, 2022, 11:49am UTC](https://discuss.elastic.co/t/auditbeat-conditional-processing-if-then-else/295697 "2022-01-28T11:49:31Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)
#### Post date: [January 28, 2022, 11:49am UTC](https://discuss.elastic.co/t/auditbeat-conditional-processing-if-then-else/295697/1 "2022-01-28T11:49:31Z")
For reference on what works and what doesn't in processors in auditbeat.
Adding multiple conditions(like an OR condition) works fine like this:
```auto
processors:
- if:
equals:
process.executable: "/home/node_exporter"
then:
drop_event:
if:
equals:
destination.port: 5044
then:
drop_event:
else:
```
But if you try to combine multiple conditions under one IF, it fails. The below will fail:
```auto
processors:
- if:
equals:
process.executable: "/home/node_exporter"
then:
drop_event:
if:
or:
equals:
destination.port: 5044
equals:
destination.port: 8081
then:
drop_event:
else:
```
Likewise AND conditions also do not work
```auto
if:
and:
equals:
destination.port: 555
equals:
destination.ip: 3.3.3.3
then:
drop_event:
```
I will editing this to add more examples as I figure out the rules, since there are zero good examples of this provided by Elastic or seemingly published anywhere.
_EDITED FOR SOME WORKING EXAMPLES._
This seems to work for multiple OR's.
```auto
processors:
- if:
or:
- equals:
process.executable: "/home/node_exporter"
- equals:
destination.port: 5044
- equals:
destination.port: 8081
- equals:
destination.ip: "127.0.0.53"
then:
drop_event:
```
And finally, here is how to add multiple nested or/and conditions
```auto
processors:
- if:
or:
- equals:
process.executable: "/home/node_exporter"
- equals:
destination.port: 5044
- equals:
destination.port: 8081
- equals:
destination.ip: "127.0.0.53"
- and:
- equals:
destination.port: 555
- or:
- equals:
destination.ip: 3.3.3.3
- equals:
destination.ip: 4.4.4.4
then:
drop_event:
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 25, 2022, 1:49pm UTC](https://discuss.elastic.co/t/auditbeat-conditional-processing-if-then-else/295697/2 "2022-02-25T13:49:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.