# Conditional check on json response

**URL:** <https://discuss.elastic.co/t/conditional-check-on-json-response/77738>\
**Category:** Logstash\
**Created:** [March 7, 2017, 11:08pm UTC](https://discuss.elastic.co/t/conditional-check-on-json-response/77738 "2017-03-07T23:08:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![timmy8ken](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@timmy8ken](https://discuss.elastic.co/u/timmy8ken)\
**Post date:** [March 7, 2017, 11:08pm UTC](https://discuss.elastic.co/t/conditional-check-on-json-response/77738/1 "2017-03-07T23:08:57Z")

</div>

Hello Elastic World,

I have got logs from our web application shipping into Logstash then onto Elasticsearch. It's all working very well, however I would like to filter some entries in our logs to trigger an alert in Zabbix using the Zabbix output plugin. I have got this working for other logs based on this output configuration in logstash:

```
output {
    if [level] == 'ERROR' {
		zabbix {
			zabbix_host => "[@metadata][z_host]"
			zabbix_key => "[@metadata][z_key]"
			zabbix_server_host => "svr-zab-01"
		}
		
	}

```

However I am having troubles getting the conditonal to trigger on the output from a JSON filter.

This is the raw JSON data in the log file:

`{"data":null,"success":false,"errorMessage":"Unable to find suburb with postcode 2929","displayError":"Error processing request","statusCode":400,"traceId":"4e1d1e7f-3b8f-40cc-ab52-df0755852d97"}`

This is my JSON filter in logstash:

```
json {
			source => "RAW_Response"
			target => "Response"
		}

```

Then I can see the json parsed data in kibana:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/0/909bef0d00aa57936c881622bf9375ccaafb12e6.png)

What I want to do is if the success field is false, output to Zabbix where I will then set up a trigger to send an alert. I have tried with this conditional, however it never fires:

```
output {
	if [Response][success] == 'false' {
		zabbix {
			zabbix_host => "[@metadata][z_host]"
			zabbix_key => "[@metadata][z_key]"
			zabbix_server_host => "svr-zab-01"
		}
		
	}

```

Can someone see what I am doing wrong with this conditional?

Cheers,

Tim

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 9, 2017, 3:23pm UTC](https://discuss.elastic.co/t/conditional-check-on-json-response/77738/2 "2017-03-09T15:23:43Z")

</div>

The success value is a boolean value and not a string. Try this instead:

```
if ! [Response][success] {
```

---

<div class="post-metadata">

**Author:** ![timmy8ken](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@timmy8ken](https://discuss.elastic.co/u/timmy8ken)\
**Post date:** [March 15, 2017, 6:18am UTC](https://discuss.elastic.co/t/conditional-check-on-json-response/77738/3 "2017-03-15T06:18:20Z")

</div>

Hi,

That is the format I was looking for.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2017, 6:18am UTC](https://discuss.elastic.co/t/conditional-check-on-json-response/77738/4 "2017-04-12T06:18:19Z")

</div>

Closed on April 12, 2017, 6:18am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.