# Can a dissect processor have a condition?

**URL:** <https://discuss.elastic.co/t/can-a-dissect-processor-have-a-condition/242578>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 24, 2020, 11:41pm UTC](https://discuss.elastic.co/t/can-a-dissect-processor-have-a-condition/242578 "2020-07-24T23:41:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![geoffreyphippsuw](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@geoffreyphippsuw](https://discuss.elastic.co/u/geoffreyphippsuw)\
**Post date:** [July 24, 2020, 11:41pm UTC](https://discuss.elastic.co/t/can-a-dissect-processor-have-a-condition/242578/1 "2020-07-24T23:41:15Z")

</div>

Our EFK stack is receiving logs from several different kubernetes containers and other sources that use differing log patterns. I have created a dissect processor that can extract certain fields from the message field. But I need a different grok pattern for each kind of container. I decided to use a condition, like so:

```auto
processors:
  - dissect:
      when:
        contains:
          container.name: "jobmon" 
      tokenizer: "%{LOGLEVEL:log.level}:%{GREEDYDATA:package}:%{GREEDYDATA:details}"
      field: "message"
      target_prefix: "python"

```

But I get yaml parse errors on the "when" condition. It works without the when clause.  
This is using elasticsearch 7.8

Is this possible? Is there a better way?

Thanks  
Geoff

---

<div class="post-metadata">

**Author:** ![geoffreyphippsuw](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@geoffreyphippsuw](https://discuss.elastic.co/u/geoffreyphippsuw)\
**Post date:** [July 25, 2020, 12:44am UTC](https://discuss.elastic.co/t/can-a-dissect-processor-have-a-condition/242578/2 "2020-07-25T00:44:56Z")

</div>

Hmm, I might have fixed it, there was an extra line I had missed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2020, 2:44am UTC](https://discuss.elastic.co/t/can-a-dissect-processor-have-a-condition/242578/3 "2020-08-22T02:44:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.