# Begin collate or multiline with one conditional, but include more once running

**URL:** <https://discuss.elastic.co/t/begin-collate-or-multiline-with-one-conditional-but-include-more-once-running/27065>\
**Category:** Logstash\
**Created:** [August 7, 2015, 8:14pm UTC](https://discuss.elastic.co/t/begin-collate-or-multiline-with-one-conditional-but-include-more-once-running/27065 "2015-08-07T20:14:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nekatreven](https://avatars.discourse-cdn.com/v4/letter/n/a6a055/32.png) [@nekatreven](https://discuss.elastic.co/u/nekatreven)\
**Post date:** [August 7, 2015, 8:14pm UTC](https://discuss.elastic.co/t/begin-collate-or-multiline-with-one-conditional-but-include-more-once-running/27065/1 "2015-08-07T20:14:41Z")

</div>

Hello,

I'm planning to use the multiline filter or (the actual current plan) the collate filter to combine events into digests for emailing, similar to this example I found when searching around...:

```
input {
    ....
}

filter {
    grok {
       ... # creates a "http_response" field
    }
    if [http_response] =~ /^5\d\d$/ {
        clone {
            add_tag => "_for_collation"
            clones => "all"
        }
        if "_for_collation" in [tags] {
            collate {
                add_tag => "_collated"
            }
        }
    } else {
        drop { }
    }
}

output {
    if "_for_collation" in [tags] {
        email {
            ...
        }
    }
}

```

My question is whether it is possible to "start" a collation with a conditional (such as the '=~ /^5\d\d$/') used above, but once a collation is running use another set of conditionals to include more events such as "all apache-access that isn't http200OK" plus "all application-log where message is not 'access denied please login'".

I can code up **that** list of conditionals and I already have some notifications working via email... I'm just stumped on the "if $collation\_already\_running" part that it seems should wrap them.

In case it is relevant the pipeline is LSF-\>LS-\>Redis-\>LS-\>ES/email. LS is v1.4.2.

Thank you,  
Mark

---

<div class="post-metadata">

**Author:** ![nekatreven](https://avatars.discourse-cdn.com/v4/letter/n/a6a055/32.png) [@nekatreven](https://discuss.elastic.co/u/nekatreven)\
**Post date:** [August 7, 2015, 8:31pm UTC](https://discuss.elastic.co/t/begin-collate-or-multiline-with-one-conditional-but-include-more-once-running/27065/2 "2015-08-07T20:31:28Z")

</div>

Alternatively... if it isn't too terrible for the performance... maybe I could run the collation all the time on the wider set of conditionals but have a metrics event come by that drops it if no undesirable events have been counted?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/begin-collate-or-multiline-with-one-conditional-but-include-more-once-running/27065/3 "2017-07-06T05:32:34Z")

</div>

Closed on July 6, 2017, 5:32am UTC