# Conditional being ignored for grok match
**URL:** https://discuss.elastic.co/t/conditional-being-ignored-for-grok-match/58010
**Category:** Logstash
**Created:** [August 15, 2016, 8:51am UTC](https://discuss.elastic.co/t/conditional-being-ignored-for-grok-match/58010 "2016-08-15T08:51:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@harrytewkesbury](https://discuss.elastic.co/u/harrytewkesbury)
#### Post date: [August 15, 2016, 8:51am UTC](https://discuss.elastic.co/t/conditional-being-ignored-for-grok-match/58010/1 "2016-08-15T08:51:08Z")
Hi all,
I have a working filter for a specific log, and I am happy with that. However, one other log is being matched on it, even though the conditional I am using should not do so. I am matching on tags.
`if "access" and "apache" in [tags] { grok { match => ["message", "%{BACKOFFICEAPACHELOG}"] overwrite => ["timestamp", "message"] tag_on_failure => ["_grokfail_access"] } date { match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] add_tag => ["dateparsesuccess"] } }`
Filebeat sends a log, tagged with "apache" and "access" and this parses nicely. Another log on the same device is sent, but tagged differently: it is tagged "apache" but NOT "access". Why is this log being matched with this pattern? The log format is different, so the grok parse fails (time stamp format is different), and clutters my logstash log file. No bueno. Any thoughts?
Filebeat config here:
`filebeat:
prospectors:
-
paths:
- /var/log/php\_cli.log
input\_type: php\_error
fields\_under\_root: true
fields:
host: bohost0
tags: ["php","error","bo","cli","internal"]
-
paths:
- /var/www/bo..local/logs/access.ssl.log
input\_type: apache\_access
fields\_under\_root: true
fields:
host: bohost0
tags: ["apache","access","bo","internal"]
-
paths:
- /var/www/bo..local/logs/error.ssl.log
input\_type: apache\_error
fields\_under\_root: true
fields:
host: bohost0
tags: ["apache","error","bo","internal"]
registry\_file: /var/lib/filebeat/registry
`
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 15, 2016, 10:41am UTC](https://discuss.elastic.co/t/conditional-being-ignored-for-grok-match/58010/2 "2016-08-15T10:41:47Z")
```
if "access" and "apache" in [tags] {
```
This doesn't work as you think. Try this instead:
```
if "access" in [tags] and "apache" in [tags] {
```
---
### Author:  [@harrytewkesbury](https://discuss.elastic.co/u/harrytewkesbury)
#### Post date: [August 15, 2016, 11:08am UTC](https://discuss.elastic.co/t/conditional-being-ignored-for-grok-match/58010/3 "2016-08-15T11:08:59Z")
Oh my goodness, my boolean needs some work then, obviously! Thanks, that did the trick. I assume it was parsing it as "If 'access'" (end logic) and then "if 'apache' in tags", then grok. Since my two logs both had apache in the tags, it was running it on both.
Awesome!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/conditional-being-ignored-for-grok-match/58010/4 "2017-07-06T04:43:30Z")