# Checking Existence of Sub-Field Revisited

**URL:** <https://discuss.elastic.co/t/checking-existence-of-sub-field-revisited/164862>\
**Category:** Logstash\
**Created:** [January 18, 2019, 8:57pm UTC](https://discuss.elastic.co/t/checking-existence-of-sub-field-revisited/164862 "2019-01-18T20:57:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rudyamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rudyamid/32/38393_2.png) [@rudyamid](https://discuss.elastic.co/u/rudyamid)\
**Post date:** [January 18, 2019, 8:57pm UTC](https://discuss.elastic.co/t/checking-existence-of-sub-field-revisited/164862/1 "2019-01-18T20:57:43Z")

</div>

Looking at previous topics, it seems like the IF-Statement check works, but I haven't been able to prove it in my environment. The logstash conf file looks like this:

```
  if ![system][auth][ssh][ip] {
   geoip {
    source => "[system][auth][ssh][ip]"
    target => "[system][auth][ssh][geoip]"
   }
  }

```

But the geoip function is still called, producing \_geoip\_lookup\_failure, ignoring the ! expression:

```
{
    "_index" : "syslogsb-2019.01",
    "_type" : "doc",
    "_id" : "Yz5BXmgBYjx6Cscsjw4P",
    "_score" : 1.0,
    "_source" : {
      "input" : {
        "type" : "log"
      },
      "@timestamp" : "2019-01-17T23:59:35.000Z",
      "tags" : [
        "system",
        "auth",
        **"_geoip_lookup_failure"**
      ],
      "beat" : { },
      "prospector" : {
        "type" : "log"
      },
      "source" : "/var/log/auth.log",
      "offset" : 195606,
      "system" : {
        "auth" : {
          "timestamp" : "Jan 17 15:59:35",
          "message" : "pam_unix(sshd:auth): check pass; user unknown",
          "hostname" : "myhost",
          "program" : "sshd",
          "pid" : "8388"
        }
      }
    }

```

I'm not sure what's wrong with it. Can anyone confirm?

Thanks  
Rudy

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 18, 2019, 9:22pm UTC](https://discuss.elastic.co/t/checking-existence-of-sub-field-revisited/164862/2 "2019-01-18T21:22:07Z")

</div>

> [@rudyamid](#):
>
> if ![system][auth][ssh][ip] {

That should not be negated.

---

<div class="post-metadata">

**Author:** ![rudyamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rudyamid/32/38393_2.png) [@rudyamid](https://discuss.elastic.co/u/rudyamid)\
**Post date:** [January 18, 2019, 9:38pm UTC](https://discuss.elastic.co/t/checking-existence-of-sub-field-revisited/164862/3 "2019-01-18T21:38:49Z")

</div>

So what should be the expression?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 18, 2019, 10:06pm UTC](https://discuss.elastic.co/t/checking-existence-of-sub-field-revisited/164862/4 "2019-01-18T22:06:59Z")

</div>

```
if ![system][auth][ssh][ip] {
   geoip {
       source => "[system][auth][ssh][ip]"

```

This says "if the field [system][auth][ssh][ip] does **not** exist then run geoip against it". That will always fail. You should use

```
if [system][auth][ssh][ip] {
```

---

<div class="post-metadata">

**Author:** ![rudyamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rudyamid/32/38393_2.png) [@rudyamid](https://discuss.elastic.co/u/rudyamid)\
**Post date:** [January 18, 2019, 10:25pm UTC](https://discuss.elastic.co/t/checking-existence-of-sub-field-revisited/164862/5 "2019-01-18T22:25:01Z")

</div>

Ah, that makes sense. _forehead slap_  
What threw me off was when system.auth.ssh.ip does exists, and the same IF-Expression ran geoip anyway.

```
{
    "_index" : "syslogsb-2019.01",
    "_type" : "doc",
    "_id" : "1D5FXmgBYjx6Cscs6BTc",
    "_score" : 1.0,
    "_source" : {
      "input" : {
        "type" : "log"
      },
      "@timestamp" : "2019-01-18T00:04:22.000Z",
      "tags" : [
        "system",
        "auth"
      ],
      "beat" : { },
      "prospector" : {
        "type" : "log"
      },
      "source" : "/var/log/auth.log",
      "offset" : 199546,
      "system" : {
        "auth" : {
          "ssh" : {
            "geoip" : {
              "ip" : "202.129.29.135",
              "continent_code" : "AS",
              "country_code2" : "TH",
              "country_code3" : "TH",
              "location" : {
                "lat" : 13.75,
                "lon" : 100.4667
              },
              "latitude" : 13.75,
              "longitude" : 100.4667,
              "timezone" : "Asia/Bangkok",
              "country_name" : "Thailand"
            },
            "event" : "Failed",
            "port" : "34411",
            "ip" : "202.129.29.135",
            "method" : "password"
          },
          "timestamp" : "Jan 17 16:04:22",
          "hostname" : "myhost",
          "pid" : "8820",
          "user" : "cron"
        }
      }
    }
  }

```

Anyway, it works now. Thanks for your help!

regards  
Rudy

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2019, 10:25pm UTC](https://discuss.elastic.co/t/checking-existence-of-sub-field-revisited/164862/6 "2019-02-15T22:25:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.