# Conditional checks in mutate gsub
**URL:** https://discuss.elastic.co/t/conditional-checks-in-mutate-gsub/141564
**Category:** Logstash
**Created:** [July 25, 2018, 12:28pm UTC](https://discuss.elastic.co/t/conditional-checks-in-mutate-gsub/141564 "2018-07-25T12:28:39Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)
#### Post date: [July 25, 2018, 12:28pm UTC](https://discuss.elastic.co/t/conditional-checks-in-mutate-gsub/141564/1 "2018-07-25T12:28:39Z")
Hello,
When parsing WAS System out logs, I want to check the EventType and replace the abbreviation with full Description.
like
EventType (Replace with) Full Description
"I" --\> "Informational"
"F" --\> "Fatal"
"D" --\> "Detail"
"A" --\> "Audit" etc..
I have the syntax something like this.. but not sure which is correct and very efficient for my conditional checks.
Syntax A
```
mutate{
gsub => ["EventType","I","Informational"]
gsub => ["EventType","F","Fatal"]
gsub => ["EventType","D","Detail"]
gsub => ["EventType","A","Audit"]
}
```
Syntax B
```
mutate{
if EventType == "I" {
gsub => ["EventType","I","Informational"]
}else if EventType == "F" {
gsub => ["EventType","F","Fatal"]
}else if EventType == "D" {
gsub => ["EventType","D","Detail"]
}else if EventType == "A" {
gsub => ["EventType","A","Audit"]
}
}
```
Which is correct ? or suggest me the correct and efficient systax.
Thanks in Advance.
Thanks
Fredrick
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 25, 2018, 12:31pm UTC](https://discuss.elastic.co/t/conditional-checks-in-mutate-gsub/141564/2 "2018-07-25T12:31:47Z")
Syntax B will not work, you cannot have a conditional inside a filter. Syntax A would work, although it could be a single gsub instead of 4.
You could also use a [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter.
---
### Author:  [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)
#### Post date: [July 25, 2018, 1:28pm UTC](https://discuss.elastic.co/t/conditional-checks-in-mutate-gsub/141564/3 "2018-07-25T13:28:29Z")
Thanks for the response Badger.
this is the gsub syntax
```
mutate{
gsub =>[ "EventType","I","Informational",
"EventType","F","Fatal",
"EventType","D","Detail",
"EventType","A","Audit" ]
}
```
regarding translate filter, this could be the systax. please confirm.
```
translate{
field => "EventType"
dictionary => {
"I" => "Informational",
"F" => "Fatal",
"D" => "Detail",
"A" => "Audit"
}
}
```
Now I have two ways to solve my problem.
But which one is very efficient ? mutate or translate filter
Advice me.. thanks
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 25, 2018, 2:42pm UTC](https://discuss.elastic.co/t/conditional-checks-in-mutate-gsub/141564/4 "2018-07-25T14:42:54Z")
Those look right. I don't think it will make much difference in efficiency.
---
### Author:  [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)
#### Post date: [July 25, 2018, 2:44pm UTC](https://discuss.elastic.co/t/conditional-checks-in-mutate-gsub/141564/5 "2018-07-25T14:44:44Z")
Okay .. Thank you very much Badger..
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2018, 2:44pm UTC](https://discuss.elastic.co/t/conditional-checks-in-mutate-gsub/141564/6 "2018-08-22T14:44:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.