# Can't make conditionnal filtering to work **URL:** \ **Category:** Logstash\ **Created:** [November 7, 2016, 9:33am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191 "2016-11-07T09:33:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Houss](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@Houss](https://discuss.elastic.co/u/Houss)\ **Post date:** [November 7, 2016, 9:33am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191/1 "2016-11-07T09:33:31Z")
Hello, I plan on migrating to logstash (from graylog) and I'm facing a problem with the conditionnal filtering. Without the condition, the grok pattern works fine and as expected. However, if I put the condition, it will stop parsing completely. Here's the code : ``` input { beats { port => 5048 type => "test" } } filter { if [type] == "test" { grok { match => { "message" => "%{NUMBER:duration}\s%{IP:client_address}\s%{WORD:cache_result}/%{POSINT:status_code}\s%{NUMBER:bytes}\s%{WORD:request_method}\s%{NOTSPACE:url}\s(%{NOTSPACE:user}|-)\s%{WORD:hierarchy_code}/%{IPORHOST:server}\s%{NOTSPACE:content_type}" } } } } ``` Any insights on what I'm doing wrong ? Thanks. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 7, 2016, 9:34am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191/2 "2016-11-07T09:34:41Z")
What does an event look like? Use a `stdout { codec => rubydebug }` output to inspect it. ---
**Author:** ![Houss](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@Houss](https://discuss.elastic.co/u/Houss)\ **Post date:** [November 7, 2016, 10:12am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191/4 "2016-11-07T10:12:03Z")
It seems that I misunderstood how logstash works, and can't put "type =\> "thing" " in the input. I tried the condition with some existing field like host or type and it worked fine. But it seems that it doesn't work for any field. I tried to use a condition on [beat.name](http://beat.name) (generated by filebeat if i'm not mistaken) andit didn't work. Also tried tags, same result. Host will do for now but it would be nice to understand why it doesn't work for some fields. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 7, 2016, 11:09am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191/5 "2016-11-07T11:09:14Z")
If you show us what you tried we can probably tell you why it didn't work. ---
**Author:** ![Houss](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@Houss](https://discuss.elastic.co/u/Houss)\ **Post date:** [November 7, 2016, 11:20am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191/6 "2016-11-07T11:20:13Z")
``` input { beats { port => 5048 } } filter { if [host] == "servername" { grok { match => { "message" => "%{NUMBER:duration}\s%{IP:client_address}\s%{WORD:cache_result}/%{POSINT:status_code}\s%{NUMBER:bytes}\s%{WORD:request_method}\s%{NOTSPACE:url}\s(%{NOTSPACE:user}|-)\s%{WORD:hierarchy_code}/%{IPORHOST:server}\s%{NOTSPACE:content_type}" } } } } ``` Works ``` input { beats { port => 5048 } } filter { if [tags] == "squid3" { grok { match => { "message" => "%{NUMBER:duration}\s%{IP:client_address}\s%{WORD:cache_result}/%{POSINT:status_code}\s%{NUMBER:bytes}\s%{WORD:request_method}\s%{NOTSPACE:url}\s(%{NOTSPACE:user}|-)\s%{WORD:hierarchy_code}/%{IPORHOST:server}\s%{NOTSPACE:content_type}" } } } } ``` Doesn't work. The tags was specified in the filebeat conf file. Doesn't work either with name(shipper name in the filebeat conf file), [beat.name](http://beat.name), fields created by the "field" option in filebeat. Doesn't work with port either : ``` input { beats { port => 5048 } } filter { if [port] == 5048 { grok { match => { "message" => "%{NUMBER:duration}\s%{IP:client_address}\s%{WORD:cache_result}/%{POSINT:status_code}\s%{NUMBER:bytes}\s%{WORD:request_method}\s%{NOTSPACE:url}\s(%{NOTSPACE:user}|-)\s%{WORD:hierarchy_code}/%{IPORHOST:server}\s%{NOTSPACE:content_type}" } } } } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 7, 2016, 11:25am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191/7 "2016-11-07T11:25:52Z")
> ``` > if [tags] == "squid3" { > > ``` `tags` is an array that might contain multiple tags. Use this instead: ``` if "squid3" in [tags] { ``` > Doesn't work with port either Does the `port` field actually exist? And if so, is it an integer and not a string? ---
**Author:** ![Houss](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@Houss](https://discuss.elastic.co/u/Houss)\ **Post date:** [November 7, 2016, 11:30am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191/8 "2016-11-07T11:30:15Z")
You're right, tags was an array, your solution resolved the problem. Port isn't indeed, I made a mistake. I will go with the tags condition I guess. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 5, 2016, 11:30am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191/9 "2016-12-05T11:30:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.