# Beats processors: else if?

**URL:** <https://discuss.elastic.co/t/beats-processors-else-if/197608>\
**Category:** Beats\
**Created:** [August 31, 2019, 8:12pm UTC](https://discuss.elastic.co/t/beats-processors-else-if/197608 "2019-08-31T20:12:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![danielmotaleite](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmotaleite/32/19796_2.png) [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\
**Post date:** [August 31, 2019, 8:12pm UTC](https://discuss.elastic.co/t/beats-processors-else-if/197608/1 "2019-08-31T20:12:13Z")

</div>

In [https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html](https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html) we can see that processors have "if then else", but no word if it supports the "if then else if then else"  
I need to do multiple checks (like setting up a field for environment based on namespace and pod name) and i will have to do many "if then else ( if then else ( if then else))"

So is there any else if or elif support?

Thanks  
Daniel

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 3, 2019, 2:05pm UTC](https://discuss.elastic.co/t/beats-processors-else-if/197608/2 "2019-09-03T14:05:26Z")

</div>

You can nest the statements, but there is no `elif`.

```auto
processors:
- if:
    equals.query: "www.google.com"
  then: 
    add_tags:
      tags: google
  else:
    if:
      equals.query: "www.yahoo.com"
    then:
      drop_event: ~

```

---

<div class="post-metadata">

**Author:** ![danielmotaleite](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmotaleite/32/19796_2.png) [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\
**Post date:** [September 7, 2019, 12:39am UTC](https://discuss.elastic.co/t/beats-processors-else-if/197608/3 "2019-09-07T00:39:39Z")

</div>

yep, that is what i'm doing right now, but with 4 levels of ifs right now, it feels so wrong!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2019, 2:39am UTC](https://discuss.elastic.co/t/beats-processors-else-if/197608/4 "2019-10-05T02:39:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.