# Conditional Filter in pipeline

**URL:** <https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482>\
**Category:** Elasticsearch\
**Created:** [November 19, 2019, 10:09am UTC](https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482 "2019-11-19T10:09:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [November 19, 2019, 10:09am UTC](https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482/1 "2019-11-19T10:09:02Z")

</div>

Dear All,  
I'm new in Eleastic environment. I need an help if it is possible. I create a pipeline to process the data from filebeat system, my pipeline works correctly I'm processing various parameters, one of them is an integer value or special character ("-"). I process it as follow

us=%{INT:Param}

it works when parameter is a integer value but does not work when the value is ("-").  
Is it possible to create a conditional event as example  
if value == "-" {  
Param ="-1"  
} else {  
%{INT:Param}  
}

Thanks for your help  
best regards

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 21, 2019, 12:11pm UTC](https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482/2 "2019-11-21T12:11:46Z")

</div>

Is this a logstash or an Elasticsearch question? Can you please share a full example in order to reproduce? Thank you!

---

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [November 21, 2019, 12:51pm UTC](https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482/3 "2019-11-21T12:51:54Z")

</div>

Hello,  
This is Elastic question.  
I'm trying to create a pipeline to filter some data from nginx log (this is a custom log).  
I have to filter a value us="XXX" were it can have two different values type:

- first case us="0.221"
- second case us="-"

I do not have problem in first case but if it is possible I would set us="-1" (or 0) in second case

Thanks for your time

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 21, 2019, 3:19pm UTC](https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482/4 "2019-11-21T15:19:49Z")

</div>

Try this snippet

```auto
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": [
            "%{WORD:my_integer} %{GREEDYDATA:name}"
          ]
        }
      },
      {
        "convert": {
          "field": "my_integer",
          "type": "integer",
          "on_failure": [
            {
              "set": {
                "field": "error",
                "value": -1
              }
            }
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "123 foo bar"
      }
    },
    {
      "_source": {
        "message": "foo spameggs"
      }
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [November 21, 2019, 3:31pm UTC](https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482/5 "2019-11-21T15:31:13Z")

</div>

Thank you so much I'll do ASAP

---

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [November 22, 2019, 11:03am UTC](https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482/6 "2019-11-22T11:03:16Z")

</div>

Hello,  
I tried and it's works  
thank you so much

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2019, 11:03am UTC](https://discuss.elastic.co/t/conditional-filter-in-pipeline/208482/7 "2019-12-20T11:03:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.