# Conditional apply of filter

**URL:** <https://discuss.elastic.co/t/conditional-apply-of-filter/63537>\
**Category:** Logstash\
**Created:** [October 20, 2016, 7:13pm UTC](https://discuss.elastic.co/t/conditional-apply-of-filter/63537 "2016-10-20T19:13:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jimmy\_Shephard](https://avatars.discourse-cdn.com/v4/letter/j/cab0a1/32.png) [@Jimmy\_Shephard](https://discuss.elastic.co/u/Jimmy_Shephard)\
**Post date:** [October 20, 2016, 7:13pm UTC](https://discuss.elastic.co/t/conditional-apply-of-filter/63537/1 "2016-10-20T19:13:34Z")

</div>

Hi,

Trying to parse different kinds of log files and output to ES but seems like the condition gets ingnored by logsash when applying filters and I get some error. Any ideas what could be going wrong?

this is the structure of my config file

if [type] == "type1" {  
json {

```
    }                                                                                                                                                                                                                                                                                             
                                                                                                                                                                                                                                                                           
} else if [type] == "type2" {                                                                                                                                                                                                                     
    grok {                                                                                                                                                                                                                                                                                        
    
 }                                                                                                                                                                                                                                                                                        
}else if [type] == "type3"{                                                                                                                                                                                                                                                                
                                                                                                                                                                                                                                                                                                  
                                                                                                                                                                                                                                                                                                  
    csv {                                                                                                                                                                                                                                                                                         
                                                                                                                                                                                                                                                                      
    }                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
                                                                                                                                                                                                                                                                                                  
}      

```

I get grock parse errors for files of type3 though im not applying grok filter to the type.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 21, 2016, 5:56am UTC](https://discuss.elastic.co/t/conditional-apply-of-filter/63537/2 "2016-10-21T05:56:25Z")

</div>

Do you have multiple files in /etc/logstash/conf.d? Is there an unconditional grok filter in one of the other files?

---

<div class="post-metadata">

**Author:** ![Jimmy\_Shephard](https://avatars.discourse-cdn.com/v4/letter/j/cab0a1/32.png) [@Jimmy\_Shephard](https://discuss.elastic.co/u/Jimmy_Shephard)\
**Post date:** [October 21, 2016, 3:21pm UTC](https://discuss.elastic.co/t/conditional-apply-of-filter/63537/3 "2016-10-21T15:21:26Z")

</div>

Yes I do have multiple files in the conf.d. dir. Looked at all but grok was being applied conditionally there too. Seems like just a tag though. Able to see actual problem in the log though, mapper parsing exception  
Still trying to figure that

---

<div class="post-metadata">

**Author:** ![Jimmy\_Shephard](https://avatars.discourse-cdn.com/v4/letter/j/cab0a1/32.png) [@Jimmy\_Shephard](https://discuss.elastic.co/u/Jimmy_Shephard)\
**Post date:** [October 26, 2016, 10:34pm UTC](https://discuss.elastic.co/t/conditional-apply-of-filter/63537/4 "2016-10-26T22:34:00Z")

</div>

Eventually found rogue grok filters in other files. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/conditional-apply-of-filter/63537/5 "2017-07-06T04:32:30Z")

</div>