# Conditional Filter issue

**URL:** <https://discuss.elastic.co/t/conditional-filter-issue/227990>\
**Category:** Logstash\
**Created:** [April 14, 2020, 8:15pm UTC](https://discuss.elastic.co/t/conditional-filter-issue/227990 "2020-04-14T20:15:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bikramsingh](https://avatars.discourse-cdn.com/v4/letter/b/e56c9b/32.png) [@bikramsingh](https://discuss.elastic.co/u/bikramsingh)\
**Post date:** [April 14, 2020, 8:15pm UTC](https://discuss.elastic.co/t/conditional-filter-issue/227990/1 "2020-04-14T20:15:11Z")

</div>

I have this filter in the config file, i trying to validate it using in build test config functionality. I am getting error.

```auto
filter {
  if( "Network Login" in [message]){
    if("caps_fail" in [message]){
      grok{
        match =>{"message" => "%{TIMESTAMP_ISO8601:timeStamp}"}
      }
    }else{
      grok{
        match =>{"message" => "%{TIMESTAMP_ISO8601:timeStamp}"}
      }
    }
#outer else
  }else{
    grok{
      match =>{"message" => "%{TIMESTAMP_ISO8601:timeStamp"}
    }
  }

```

I cut shot the grok patterns. I tested these patterns in the debugger before putting them here.  
Here is the error message after running : /bin/logstash --config.test\_and\_exit -f logstash.conf

```auto
[FATAL] 2020-04-14 13:01:56.137 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of [\t\r\n], "#", "{", "}" at line 20, column 17 (byte 1279) after filter {
 if( "Network Login" in [message]){
   if("caps_fail" in [message]){
     grok{
       match =>{"message" => "%{TIMESTAMP_ISO8601:timeStamp}"}
     }
   }else{
     grok{
       match =>{"message" => "%{TIMESTAMP_ISO8601:timeStamp}"}
     }
   }
#outer else
 }else{
   grok{
     match =>{"
[ERROR] 2020-04-14 13:01:56.140 [LogStash::Runner] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

```

I am trying to extract data based on strings present in the log and trying to use nested if statements. I still want to next three if statements. Not able to figure out what is wrong. Please help, Thanks

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [April 15, 2020, 8:51am UTC](https://discuss.elastic.co/t/conditional-filter-issue/227990/2 "2020-04-15T08:51:37Z")

</div>

Hi there,

first of all you missed the `}` closing the filter section. Anyway, can you post here your whole pipeline and a sample of input event, too?

---

<div class="post-metadata">

**Author:** ![bikramsingh](https://avatars.discourse-cdn.com/v4/letter/b/e56c9b/32.png) [@bikramsingh](https://discuss.elastic.co/u/bikramsingh)\
**Post date:** [April 15, 2020, 4:18pm UTC](https://discuss.elastic.co/t/conditional-filter-issue/227990/3 "2020-04-15T16:18:12Z")

</div>

Thanks, You are right, it just missing }. thanks

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [April 16, 2020, 1:54pm UTC](https://discuss.elastic.co/t/conditional-filter-issue/227990/4 "2020-04-16T13:54:14Z")

</div>

No problem 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2020, 1:54pm UTC](https://discuss.elastic.co/t/conditional-filter-issue/227990/5 "2020-05-14T13:54:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.