# Conditional Filter only grok IF **URL:** \ **Category:** Logstash\ **Created:** [September 5, 2018, 6:18pm UTC](https://discuss.elastic.co/t/conditional-filter-only-grok-if/147458 "2018-09-05T18:18:28Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jenyphur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenyphur/32/40735_2.png) [@jenyphur](https://discuss.elastic.co/u/jenyphur)\ **Post date:** [September 5, 2018, 6:18pm UTC](https://discuss.elastic.co/t/conditional-filter-only-grok-if/147458/1 "2018-09-05T18:18:28Z")
Hi there, so I am receiving syslogs with different formats. I ONLY want to grok out the ones that have the characters "[App/" in them. The others, I would like to ignore and NOT send to ES. Here's an example of a log: 249 \<14\>1 2018-09-05T18:12:19.71683+00:00 eTDS.Dev.redge-ms-dev 27fb291c-5b1f-4b6c-aac4-44fa261f400a [APP/PROC/WEB/0] - - at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496) [tomcat-embed-core-8.5.31.jar!/:8.5.31] What I thought I could do was this: filter { if [type] == "syslog" { if "[APP/" in [message] { grok { match =\> grokpattern here } } } } But it still seems to be passing on the logs that do NOT contain [APP/ Any ideas? What am I missing? Thanks. Jen Update: Ok, I see what it's doing. It's doing what I am telling it to do I suppose.. when it sees a log that doesn't have "[APP/", it doesn't try and parse it which results in no grokfailure (good), but still sends it on to ElasticSearch (bad). So do I have to add an else statement and add a 'tag' and then in the output ONLY send logs that don't have that tag? Jen ---
**Author:** ![jenyphur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenyphur/32/40735_2.png) [@jenyphur](https://discuss.elastic.co/u/jenyphur)\ **Post date:** [September 5, 2018, 6:49pm UTC](https://discuss.elastic.co/t/conditional-filter-only-grok-if/147458/2 "2018-09-05T18:49:25Z")
I think I figured it out myself...put a conditional statement in the output section as well...duh. ---
**Author:** ![abhiroyg](https://avatars.discourse-cdn.com/v4/letter/a/e9bcb4/32.png) [@abhiroyg](https://discuss.elastic.co/u/abhiroyg)\ **Post date:** [September 6, 2018, 5:25am UTC](https://discuss.elastic.co/t/conditional-filter-only-grok-if/147458/3 "2018-09-06T05:25:56Z")
Or you can use drop filter plugin [https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-drop.html](https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-drop.html) ---
**Author:** ![evilbit77](https://avatars.discourse-cdn.com/v4/letter/e/a6a055/32.png) [@evilbit77](https://discuss.elastic.co/u/evilbit77)\ **Post date:** [September 6, 2018, 5:59am UTC](https://discuss.elastic.co/t/conditional-filter-only-grok-if/147458/4 "2018-09-06T05:59:14Z")
That works, but if you're going to have a lot of different config files or data types processed through logstash, I'd recommend tagging files as they meet your criteria, then setting your output filters based on tags. It's a little easier and cleaner to keep track of, IMO. ---
**Author:** ![jenyphur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenyphur/32/40735_2.png) [@jenyphur](https://discuss.elastic.co/u/jenyphur)\ **Post date:** [September 6, 2018, 1:46pm UTC](https://discuss.elastic.co/t/conditional-filter-only-grok-if/147458/5 "2018-09-06T13:46:48Z")
Ahhhh..yes....that's what I was originally looking for, something like drop. Perfect. Thanks so much. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 4, 2018, 1:46pm UTC](https://discuss.elastic.co/t/conditional-filter-only-grok-if/147458/6 "2018-10-04T13:46:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.