# Conditional filter in logstash

**URL:** <https://discuss.elastic.co/t/conditional-filter-in-logstash/61120>\
**Category:** Logstash\
**Created:** [September 21, 2016, 11:51am UTC](https://discuss.elastic.co/t/conditional-filter-in-logstash/61120 "2016-09-21T11:51:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roberto\_Iglesias](https://avatars.discourse-cdn.com/v4/letter/r/f1d935/32.png) [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)\
**Post date:** [September 21, 2016, 11:51am UTC](https://discuss.elastic.co/t/conditional-filter-in-logstash/61120/1 "2016-09-21T11:51:45Z")

</div>

Hi and thanks for reading, i really appreciate that.  
I continue having troubles with logstash filters. In this case, i don't know how to handle conditionals with arrays.  
I have this field "amavis\_action" and its content may be something like this:

```
 "amavis_action" => [
                 [0] "position0"
                 [1] "position1"
 ]

```

Or

```
"amavis_action" => [0] "Onlyposition0",

```

I need to made a condition like this

```
if ([amavis_action] =~ "[position0, position1]") {...}
else if ([amavis_action] =~ "Onlyposition0") {...}}

```

Which is the **correct syntax** for this?  
Thanks!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 25, 2016, 7:21pm UTC](https://discuss.elastic.co/t/conditional-filter-in-logstash/61120/2 "2016-09-25T19:21:02Z")

</div>

It's not obvious what the conditional you're looking for is supposed to do. Do you want to check if the `amavis_action` field is exactly equal to e.g. `["position0", "position1"]` or `["Onlyposition0"]`?

---

<div class="post-metadata">

**Author:** ![Roberto\_Iglesias](https://avatars.discourse-cdn.com/v4/letter/r/f1d935/32.png) [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)\
**Post date:** [September 26, 2016, 11:11am UTC](https://discuss.elastic.co/t/conditional-filter-in-logstash/61120/3 "2016-09-26T11:11:54Z")

</div>

Thanks for reply. Actually, i want to do both. These are two possibilities, two cases that i want to evaluate.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 26, 2016, 12:57pm UTC](https://discuss.elastic.co/t/conditional-filter-in-logstash/61120/4 "2016-09-26T12:57:16Z")

</div>

I'd expect

```
if [amavis_action] == ["position0", "position1"] { ... }

```

to work but I haven't tried.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/conditional-filter-in-logstash/61120/5 "2017-07-06T04:36:54Z")

</div>