# Condition check eror

**URL:** https://discuss.elastic.co/t/condition-check-eror/79539
**Category:** Logstash
**Created:** [March 22, 2017, 6:54am UTC](https://discuss.elastic.co/t/condition-check-eror/79539 "2017-03-22T06:54:18Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![shijinbose](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@shijinbose](https://discuss.elastic.co/u/shijinbose)
#### Post date: [March 22, 2017, 6:54am UTC](https://discuss.elastic.co/t/condition-check-eror/79539/1 "2017-03-22T06:54:18Z")

</div>

Hi,  
I am trying to filter out "Error" from the message tag,

```
input {
 tcp {
 port => 5000
type => syslog
     }
 udp {
port => 5000
type => syslog
     }
}

filter
{
    grok
    {
            match => { "message" => "%{WORD:error} %{WORD:method}" }
    }
            if [error] =~ /Error/ {
                method => "Error Found"
    }
}

output {
 elasticsearch { hosts => ["localhost:9200"] }
file {
    path => "/root/Logger/logstash-5.2.2.log"
    codec => rubydebug
}
stdout { codec => rubydebug }
}

```

if the error pattern = "error" then i want to change the value of method to "Error Found"  
this code give me the error like this  
"Cannot load an invalid configuration {:reason=\>"Expected one of #, { at line 19, column 11 (byte 226) after filter \n{\n\tgrok \n\t{\n\t\tmatch =\> { "message" =\> "%{WORD:error} %{WORD:method}" }\n\t}\n\t\tif [error] =~ /Error/ {\n\t\t\tmethod "}"

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 22, 2017, 7:07am UTC](https://discuss.elastic.co/t/condition-check-eror/79539/2 "2017-03-22T07:07:16Z")

</div>

To change a field value use a mutate filter. I think its `replace` option is what you need in this case.

---

<div class="post-metadata">

### Author: ![shijinbose](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@shijinbose](https://discuss.elastic.co/u/shijinbose)
#### Post date: [March 22, 2017, 7:18am UTC](https://discuss.elastic.co/t/condition-check-eror/79539/3 "2017-03-22T07:18:47Z")

</div>

```
 mutate {
                     replace => { "method" => "Error Found" }
}

```

Thank you @magnusbaeck it works 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2017, 7:18am UTC](https://discuss.elastic.co/t/condition-check-eror/79539/4 "2017-04-19T07:18:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.