# Conditional forwarding in logstash.conf not working

**URL:** <https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192>\
**Category:** Logstash\
**Created:** [November 26, 2018, 1:59pm UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192 "2018-11-26T13:59:46Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gegi\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gegi_k/32/38376_2.png) [@Gegi\_K](https://discuss.elastic.co/u/Gegi_K)\
**Post date:** [November 26, 2018, 1:59pm UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/1 "2018-11-26T13:59:46Z")

</div>

Hi People,

I try to get some conditional splitting in logstash conf working, and missing something maybe...  
I use this config:

```
		input {

```

tcp {  
port =\> 5001  
type =\> syslog  
}  
udp {  
port =\> 5001  
type =\> syslog  
}  
}  
filter {  
if "Drop:" in [message] { grok { match =\> { "message" =\> "(?\<\d+\>)(?\w+\s\d+\s\d+.\d+.\d+)%{SPACE}%{HOSTNAME}%{SPACE}(?\d(._?)(:))%{SPACE}%{SPACE}%{WORD:Severity}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}(?\w+.\w+.\w+)%{SPACE}%{WORD:Action}(?.)%{SPACE}(?.)(?.)%{WORD:Protocol}(?.)(?\<interface\_IN\>(?\<=|)(._?)(?=|))(?.)%{IPV4:src}(?.)(?\<src\_port\>\d+)(?.)%{COMMONMAC:mac}(?.)%{IPV4:dst}(?.)(?\<dst\_port\>\d+)(?.)(?.)(?\<interface\_OUT\>(?\<=|)(._?)(?=|))(?.)(?.)(?(?\<=|)(._?)(?=|))" }}  
mutate { remove\_field =\> ["\_version", "@version", "\_score", "\_type", "separator1", "separator2", "separator3", "separator4", "separator5", "separator6", "separator7", "separator8", "separator9", "separator10", "separator11", "separator12", "separator13", "separator14", "separator15", "separator16", "separator17", "separator18", "separator19", "message", "misc", "port", "type", "score", "rest"] }}  
else { grok { match =\> { "message" =\> { "(?\<\d+\>)(?\w+\s\d+\s\d+.\d+.\d+)%{SPACE}%{HOSTNAME}%{SPACE}(?\d(._?)(:))%{SPACE}%{SPACE}%{WORD:Severity}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}(?\w+.\w+.\w+)%{SPACE}%{WORD:Action}(?.)%{SPACE}%{WORD:Org}(?.)%{WORD:Protocol}(?.)(?\<interface\_IN\>(?\<=|)(._?)(?=|))(?.)%{IPV4:src}(?.)(?\<src\_port\>\d+)(?.)%{COMMONMAC:mac}(?.)%{IPV4:dst}(?.)(?\<dst\_port\>\d+)(?.)(?\w+)(?.)(?\<interface\_OUT\>(?\<=|)(._?)(?=|))(?.)(?(?\<=|)(._?)(?=|))(?.)(?(?\<=|)(._?)(?=|))(?.)%{IPV4:src\_NAT}(?.)%{IPV4:dst\_NAT}(?.)(?(?\<=|)(._?)(?=|))(?.)(?\<packet\_count\>(?\<=|)(._?)(?=|))(?.)(?(?\<=|)(._?)(?=|))(?.)(?(?\<=|)(._?)(?=|))(?.)(?(?\<=|)(._?)(?=|))(?.)(?(?\<=|)(.\*?)(?=|))%{GREEDYDATA:rest}" }}}  
mutate { remove\_field =\> ["\_version", "@version", "\_score", "\_type", "separator1", "separator2", "separator3", "separator4", "separator5", "separator6", "separator7", "separator8", "separator9", "separator10", "separator11", "separator12", "separator13", "separator14", "separator15", "separator16", "separator17", "separator18", "separator19", "message", "misc", "port", "type", "score", "rest"] }}  
}  
output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
file {  
path =\> "C:\Users\Administrator\Desktop\LogTest\test.log"  
}  
}

and I get this error:  
Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 14, column 1080 (byte 2275) after filter { \n\t\tif "Drop:" in [message]

I seem to miss something but cannot see what exactly. If I comment out the else statement and build the filter with only filter { grok { match =\> { GROKFILTER}}} than it works... also the if part is working by itself, but the IF THEN I am not able to link together...

thanks for any input in advance!

Regards,  
Gergö

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 3:14pm UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/2 "2018-11-26T15:14:49Z")

</div>

Can you take the colon out of the "drop:" ? so it is just:

```
if "Drop" in [message] {
   grok { }
}
```

---

<div class="post-metadata">

**Author:** ![Gegi\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gegi_k/32/38376_2.png) [@Gegi\_K](https://discuss.elastic.co/u/Gegi_K)\
**Post date:** [November 26, 2018, 3:23pm UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/3 "2018-11-26T15:23:57Z")

</div>

Thanks for the tip, I just did and get the same error only the colon is not in the error message:

Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 15, column 1 (byte 2270) after filter {\n\t\tif "Drop" in [message] { grok { match =\>

I think it migh be something with the separation of the if then syntax as it expects something in line 15 column1 in the conf file. that position is a "}" closing in the last brace in the line:  
else { grok { match =\> { "message" =\> **{**

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 3:29pm UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/4 "2018-11-26T15:29:50Z")

</div>

You have provided a different error message this time, it is now further along the chain than last time. See this time it is line 15 not 14 and the error message is longer.

Could you post your config with proper formatting please? It is very hard to read at the moment! Thanks

---

<div class="post-metadata">

**Author:** ![Gegi\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gegi_k/32/38376_2.png) [@Gegi\_K](https://discuss.elastic.co/u/Gegi_K)\
**Post date:** [November 26, 2018, 3:31pm UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/5 "2018-11-26T15:31:55Z")

</div>

First of all thanks for hepling me, and sorry I did not get the formatting right...  
I think this should do:

```
 input {
tcp {
port => 5001
type => syslog
}
udp {
port => 5001
type => syslog
} }
filter {
	if "Drop:" in [message] { grok { match => { "message" => "(?<aid><\d+>)(?<Date>\w+\s\d+\s\d+.\d+.\d+)%{SPACE}%{HOSTNAME}%{SPACE}(?<Log>\d(.*?)(\:))%{SPACE}%{SPACE}%{WORD:Severity}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}(?<logsource>\w+.\w+.\w+)%{SPACE}%{WORD:Action}(?<misc>.)%{SPACE}(?<separator0>.)(?<separator1>.)%{WORD:Protocol}(?<separator2>.)(?<interface_IN>(?<=\|)(.*?)(?=\|))(?<separator3>.)%{IPV4:src}(?<separator4>.)(?<src_port>\d+)(?<separator5>.)%{COMMONMAC:mac}(?<separator6>.)%{IPV4:dst}(?<separator7>.)(?<dst_port>\d+)(?<separator9>.)(?<separator10>.)(?<interface_OUT>(?<=\|)(.*?)(?=\|))(?<separator11>.)(?<separator12>.)(?<Info>(?<=\|)(.*?)(?=\|))" }}
mutate { remove_field => ["_version", "@version", "_score", "_type", "separator1", "separator2", "separator3", "separator4", "separator5", "separator6", "separator7", "separator8", "separator9", "separator10", "separator11", "separator12", "separator13", "separator14", "separator15", "separator16", "separator17", "separator18", "separator19", "message", "misc", "port", "type", "score", "rest"] }}
else { grok { match => { "message" => { "(?<aid><\d+>)(?<Date>\w+\s\d+\s\d+.\d+.\d+)%{SPACE}%{HOSTNAME}%{SPACE}(?<Log>\d(.*?)(\:))%{SPACE}%{SPACE}%{WORD:Severity}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}(?<logsource>\w+.\w+.\w+)%{SPACE}%{WORD:Action}(?<misc>.)%{SPACE}%{WORD:Org}(?<separator1>.)%{WORD:Protocol}(?<separator2>.)(?<interface_IN>(?<=\|)(.*?)(?=\|))(?<separator3>.)%{IPV4:src}(?<separator4>.)(?<src_port>\d+)(?<separator5>.)%{COMMONMAC:mac}(?<separator6>.)%{IPV4:dst}(?<separator7>.)(?<dst_port>\d+)(?<separator8>.)(?<protocol>\w+)(?<separator9>.)(?<interface_OUT>(?<=\|)(.*?)(?=\|))(?<separator10>.)(?<Rule>(?<=\|)(.*?)(?=\|))(?<separator11>.)(?<Info>(?<=\|)(.*?)(?=\|))(?<separator12>.)%{IPV4:src_NAT}(?<separator13>.)%{IPV4:dst_NAT}(?<separator14>.)(?<duration>(?<=\|)(.*?)(?=\|))(?<separator15>.)(?<packet_count>(?<=\|)(.*?)(?=\|))(?<separator16>.)(?<receivedBytes>(?<=\|)(.*?)(?=\|))(?<separator17>.)(?<sentBytes>(?<=\|)(.*?)(?=\|))(?<separator18>.)(?<receivedPackets>(?<=\|)(.*?)(?=\|))(?<separator19>.)(?<sentPackets>(?<=\|)(.*?)(?=\|))%{GREEDYDATA:rest}" 
} } }
mutate { remove_field => ["_version", "@version", "_score", "_type", "separator1", "separator2", "separator3", "separator4", "separator5", "separator6", "separator7", "separator8", "separator9", "separator10", "separator11", "separator12", "separator13", "separator14", "separator15", "separator16", "separator17", "separator18", "separator19", "message", "misc", "port", "type", "score", "rest"] }
		}}
output	{
elasticsearch { hosts => ["localhost:9200"] }
file {
	path => "C:\Users\Administrator\Desktop\LogTest\test.log"
}
}
```

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 3:53pm UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/6 "2018-11-26T15:53:49Z")

</div>

> [@Gegi\_K](#):
>
> input { tcp { port =\> 5001 type =\> syslog } udp { port =\> 5001 type =\> syslog } } filter { if "Drop:" in [message] { grok { match =\> { "message" =\> "(?\<aid\>\<\d+\>)(?\<Date\>\w+\s\d+\s\d+.\d+.\d+)%{SPACE}%{HOSTNAME}%{SPACE}(?\<Log\>\d(._?)(:))%{SPACE}%{SPACE}%{WORD:Severity}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}(?\<logsource\>\w+.\w+.\w+)%{SPACE}%{WORD:Action}(?\<misc\>.)%{SPACE}(?\<separator0\>.)(?\<separator1\>.)%{WORD:Protocol}(?\<separator2\>.)(?\<interface\_IN\>(?\<=|)(._?)(?=|))(?\<separator3\>.)%{IPV4:src}(?\<separator4\>.)(?\<src\_port\>\d+)(?\<separator5\>.)%{COMMONMAC:mac}(?\<separator6\>.)%{IPV4:dst}(?\<separator7\>.)(?\<dst\_port\>\d+)(?\<separator9\>.)(?\<separator10\>.)(?\<interface\_OUT\>(?\<=|)(._?)(?=|))(?\<separator11\>.)(?\<separator12\>.)(?\<Info\>(?\<=|)(._?)(?=|))" }} mutate { remove\_field =\> ["\_version", "@version", "\_score", "\_type", "separator1", "separator2", "separator3", "separator4", "separator5", "separator6", "separator7", "separator8", "separator9", "separator10", "separator11", "separator12", "separator13", "separator14", "separator15", "separator16", "separator17", "separator18", "separator19", "message", "misc", "port", "type", "score", "rest"] }} else { grok { match =\> { "message" =\> { "(?\<aid\>\<\d+\>)(?\<Date\>\w+\s\d+\s\d+.\d+.\d+)%{SPACE}%{HOSTNAME}%{SPACE}(?\<Log\>\d(._?)(:))%{SPACE}%{SPACE}%{WORD:Severity}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}(?\<logsource\>\w+.\w+.\w+)%{SPACE}%{WORD:Action}(?\<misc\>.)%{SPACE}%{WORD:Org}(?\<separator1\>.)%{WORD:Protocol}(?\<separator2\>.)(?\<interface\_IN\>(?\<=|)(._?)(?=|))(?\<separator3\>.)%{IPV4:src}(?\<separator4\>.)(?\<src\_port\>\d+)(?\<separator5\>.)%{COMMONMAC:mac}(?\<separator6\>.)%{IPV4:dst}(?\<separator7\>.)(?\<dst\_port\>\d+)(?\<separator8\>.)(?\<protocol\>\w+)(?\<separator9\>.)(?\<interface\_OUT\>(?\<=|)(._?)(?=|))(?\<separator10\>.)(?\<Rule\>(?\<=|)(._?)(?=|))(?\<separator11\>.)(?\<Info\>(?\<=|)(._?)(?=|))(?\<separator12\>.)%{IPV4:src\_NAT}(?\<separator13\>.)%{IPV4:dst\_NAT}(?\<separator14\>.)(?\<duration\>(?\<=|)(._?)(?=|))(?\<separator15\>.)(?\<packet\_count\>(?\<=|)(._?)(?=|))(?\<separator16\>.)(?\<receivedBytes\>(?\<=|)(._?)(?=|))(?\<separator17\>.)(?\<sentBytes\>(?\<=|)(._?)(?=|))(?\<separator18\>.)(?\<receivedPackets\>(?\<=|)(._?)(?=|))(?\<separator19\>.)(?\<sentPackets\>(?\<=|)(.\*?)(?=|))%{GREEDYDATA:rest}" } } } mutate { remove\_field =\> ["\_version", "@version", "\_score", "\_type", "separator1", "separator2", "separator3", "separator4", "separator5", "separator6", "separator7", "separator8", "separator9", "separator10", "separator11", "separator12", "separator13", "separator14", "separator15", "separator16", "separator17", "separator18", "separator19", "message", "misc", "port", "type", "score", "rest"] } }} output { elasticsearch { hosts =\> ["localhost:9200"] } file { path =\> "C:\Users\Administrator\Desktop\LogTest\test.log" } }

Your formatting could do with some work, I have tidied it up for you. You had an extra bracket, try this:

```
 input {
	tcp {
		port => 5001
		type => syslog
	}
	udp {
		port => 5001
		type => syslog
	} 
}
filter {
	if "Drop:" in [message] { 
		grok { 
			match => { "message" => "(?<aid><\d+>)(?<Date>\w+\s\d+\s\d+.\d+.\d+)%{SPACE}%{HOSTNAME}%{SPACE}(?<Log>\d(.*?)(\:))%{SPACE}%{SPACE}%{WORD:Severity}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}(?<logsource>\w+.\w+.\w+)%{SPACE}%{WORD:Action}(?<misc>.)%{SPACE}(?<separator0>.)(?<separator1>.)%{WORD:Protocol}(?<separator2>.)(?<interface_IN>(?<=\|)(.*?)(?=\|))(?<separator3>.)%{IPV4:src}(?<separator4>.)(?<src_port>\d+)(?<separator5>.)%{COMMONMAC:mac}(?<separator6>.)%{IPV4:dst}(?<separator7>.)(?<dst_port>\d+)(?<separator9>.)(?<separator10>.)(?<interface_OUT>(?<=\|)(.*?)(?=\|))(?<separator11>.)(?<separator12>.)(?<Info>(?<=\|)(.*?)(?=\|))" }
		}
		mutate { 
			remove_field => ["_version", "@version", "_score", "_type", "separator1", "separator2", "separator3", "separator4", "separator5", "separator6", "separator7", "separator8", "separator9", "separator10", "separator11", "separator12", "separator13", "separator14", "separator15", "separator16", "separator17", "separator18", "separator19", "message", "misc", "port", "type", "score", "rest"] 
		}
	} else { 
		grok { 
			match => { "message" => "(?<aid><\d+>)(?<Date>\w+\s\d+\s\d+.\d+.\d+)%{SPACE}%{HOSTNAME}%{SPACE}(?<Log>\d(.*?)(\:))%{SPACE}%{SPACE}%{WORD:Severity}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}(?<logsource>\w+.\w+.\w+)%{SPACE}%{WORD:Action}(?<misc>.)%{SPACE}%{WORD:Org}(?<separator1>.)%{WORD:Protocol}(?<separator2>.)(?<interface_IN>(?<=\|)(.*?)(?=\|))(?<separator3>.)%{IPV4:src}(?<separator4>.)(?<src_port>\d+)(?<separator5>.)%{COMMONMAC:mac}(?<separator6>.)%{IPV4:dst}(?<separator7>.)(?<dst_port>\d+)(?<separator8>.)(?<protocol>\w+)(?<separator9>.)(?<interface_OUT>(?<=\|)(.*?)(?=\|))(?<separator10>.)(?<Rule>(?<=\|)(.*?)(?=\|))(?<separator11>.)(?<Info>(?<=\|)(.*?)(?=\|))(?<separator12>.)%{IPV4:src_NAT}(?<separator13>.)%{IPV4:dst_NAT}(?<separator14>.)(?<duration>(?<=\|)(.*?)(?=\|))(?<separator15>.)(?<packet_count>(?<=\|)(.*?)(?=\|))(?<separator16>.)(?<receivedBytes>(?<=\|)(.*?)(?=\|))(?<separator17>.)(?<sentBytes>(?<=\|)(.*?)(?=\|))(?<separator18>.)(?<receivedPackets>(?<=\|)(.*?)(?=\|))(?<separator19>.)(?<sentPackets>(?<=\|)(.*?)(?=\|))%{GREEDYDATA:rest}" } 
		} 
	}
	mutate { 
		remove_field => ["_version", "@version", "_score", "_type", "separator1", "separator2", "separator3", "separator4", "separator5", "separator6", "separator7", "separator8", "separator9", "separator10", "separator11", "separator12", "separator13", "separator14", "separator15", "separator16", "separator17", "separator18", "separator19", "message", "misc", "port", "type", "score", "rest"] 
	}
	}
output	{
	elasticsearch { hosts => ["localhost:9200"] }
	file {
		path => "C:\Users\Administrator\Desktop\LogTest\test.log"
	}
}

```

---

<div class="post-metadata">

**Author:** ![Gegi\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gegi_k/32/38376_2.png) [@Gegi\_K](https://discuss.elastic.co/u/Gegi_K)\
**Post date:** [November 27, 2018, 8:43am UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/7 "2018-11-27T08:43:26Z")

</div>

Dear Lewis,

now its working...! thank you for your help, learned again something! you are awesome!

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 27, 2018, 8:44am UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/8 "2018-11-27T08:44:09Z")

</div>

Glad to hear it! Please mark as solved 🙂!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 25, 2018, 8:44am UTC](https://discuss.elastic.co/t/conditional-forwarding-in-logstash-conf-not-working/158192/9 "2018-12-25T08:44:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.