# Conditional, check multiple values for a field

**URL:** <https://discuss.elastic.co/t/conditional-check-multiple-values-for-a-field/108131>\
**Category:** Logstash\
**Created:** [November 17, 2017, 12:56pm UTC](https://discuss.elastic.co/t/conditional-check-multiple-values-for-a-field/108131 "2017-11-17T12:56:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 17, 2017, 12:56pm UTC](https://discuss.elastic.co/t/conditional-check-multiple-values-for-a-field/108131/1 "2017-11-17T12:56:28Z")

</div>

Hello,

I have a pipeline on logstash where I receive messages from network devices (firewalls), parse the message using grok patterns and store them in elasticsearch.

I have three different models which I parse some kinds of messages that they send, other kind of messages I'm not done configuring the grok pattern, so I add a tag on them and store in another index.

For each device I have a tag, for example, "device01", "device02" and "device03", and another tag for the messages that do not match on grok, like "device-temp", and all the devices have the same type, for example "firewall".

On my pipeline I have a excluding conditional, for using the mutate filter, the conditional is as below:

```auto
if "device-temp" not in [tags] and [type] == "firewall" {
    mutate { things to mutate } 
}

```

This conditional works fine, but now I'm trying to change it to a including conditional, I tried the below configuration, but it did not work:

```auto
if [tags] in ["device01", "device02", "device03"] and [type] == "firewall" {
    mutate { things to mutate }
}

```

How can I do something like this? Do I need to use an `or` for each conditional? Like below:

```auto
if "device01" in [tags] or "device02" in [tags]

```

I'm using Logstash 5.4.3

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 17, 2017, 3:58pm UTC](https://discuss.elastic.co/t/conditional-check-multiple-values-for-a-field/108131/2 "2017-11-17T15:58:37Z")

</div>

> ```
> if "device01" in [tags] or "device02" in [tags]
> 
> ```

Yes, I think this is what you need to do. But I suggest you don't use tags for this purpose but rather a field with a singular value, perhaps named `device`. Then you can use the `in` operator, plus it makes more sense from a data modelling perspective.

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [November 17, 2017, 4:14pm UTC](https://discuss.elastic.co/t/conditional-check-multiple-values-for-a-field/108131/3 "2017-11-17T16:14:06Z")

</div>

In addition to what Magnus said, I would move the `[type] == "firewall"` to be the first conditional to test - this is so any event of a not firewall type do not need to have the remaining conditionals checked at all.

And you need to group the OR sections with parentheses (...)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 17, 2017, 4:35pm UTC](https://discuss.elastic.co/t/conditional-check-multiple-values-for-a-field/108131/4 "2017-11-17T16:35:06Z")

</div>

> [@guyboertje](#):
>
> And you need to group the OR sections with parentheses (...)

So, I would need something like this?

```auto
if [type] == "firewall" and ("device01" in [tags] or "device02" in [tags]) {
    mutate { things to mutate }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2017, 4:35pm UTC](https://discuss.elastic.co/t/conditional-check-multiple-values-for-a-field/108131/5 "2017-12-15T16:35:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.