# Conditional statement not working in filter **URL:** \ **Category:** Logstash\ **Created:** [January 21, 2020, 4:00am UTC](https://discuss.elastic.co/t/conditional-statement-not-working-in-filter/215817 "2020-01-21T04:00:47Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Charles\_Yuliansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles_yuliansen/32/45664_2.png) [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Post date:** [January 21, 2020, 4:00am UTC](https://discuss.elastic.co/t/conditional-statement-not-working-in-filter/215817/1 "2020-01-21T04:00:47Z")
Im trying to learn conditional filtering, the grok outside expression successfully parsed, but not with grok inside conditional expression. **target** [2020-01-09 08:32:46] VERBOSE[18962][C-0000ceae] pbx.c: Executing [s@macro-dialout-trunk:26] NoOp("PJSIP/3513-0001108e", "Dial failed for some reason with DIALSTATUS = BUSY and HANGUPCAUSE = 19") in new stack [2020-01-09 08:32:46] VERBOSE[18962][C-0000ceae] pbx.c: Executing [s@macro-dialout-trunk:26] NoOp("PJSIP/3513-0001108e", "Dial failed for some reason with DIALSTATUS = BUSY and HANGUPCAUSE = 19") in new stack > filter > { > grok > { > match =\> > { > "message" =\> "[%{TIMESTAMP\_ISO8601:log\_timestamp}] +(?\(?i)(?:debug|notice|warning|error|verbose|dtmf|fax|security)(?-i))[%{INT:thread\_id}](?:[%{DATA:call\_thread\_id}])? %{DATA:module\_name}: %{WORD:action}\s[%{DATA:TARGET}@%{DATA:dialplan\_context}:%{DATA:dialplan\_priority}]\s%{GREEDYDATA:log\_message}" > } > add\_field =\> ["receiver\_timestamp", "%{@timestamp}"] > add\_field =\> ["process\_name","asterisk\_failed"] > } > if [action] == "Executing" and [dialplan\_priority]=="1"{ > grok > { > match =\> > { > "log\_message"=\>"%{DATA:asterisk\_app}("%{DATA:protocol}/%{DATA:EXT}-%{DATA:channel}",\s"%{DATA:problem1}-\s%{DATA:problem2}")\s%{GREEDYDATA:all}" > } > } > } > if [action] == "Executing" and [dialplan\_priority]=="26"{ > grok > { > match =\> > { > "log\_message"=\>"%{DATA:asterisk\_app}("%{DATA:protocol}/%{DATA:EXT}-%{DATA:channel}",\s"%{DATA:problem1}\sand\s%{DATA:problem2}")\s%{GREEDYDATA:all}" > } > } > } > } are there some stuff that needed to be imported to use conditional if? ---
**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\ **Post date:** [January 21, 2020, 7:08am UTC](https://discuss.elastic.co/t/conditional-statement-not-working-in-filter/215817/2 "2020-01-21T07:08:46Z")
Hi By "successfuly parsed" I assume you mean that `action` contains "Executing", `dialplan_priority` is "26", as per your example, and your `log_message` is > [@Charles\_Yuliansen](#): > > NoOp("PJSIP/3513-0001108e", "Dial failed for some reason with DIALSTATUS = BUSY and HANGUPCAUSE = 19") in new stack I think you should probably escape the quotes you have inside the match sentence. It would help if you could share the otuput you are getting from your config (use `stdout{}` for debugging). Hope this helps ---
**Author:** ![Charles\_Yuliansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles_yuliansen/32/45664_2.png) [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Post date:** [January 21, 2020, 8:01am UTC](https://discuss.elastic.co/t/conditional-statement-not-working-in-filter/215817/3 "2020-01-21T08:01:17Z")
hi there, thank you for your response, it was one of 2 target, and i forgot to add the other target. i will provide the stdout soon, but can you spot if there are any problem or mistake with my code? ---
**Author:** ![Charles\_Yuliansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles_yuliansen/32/45664_2.png) [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Post date:** [January 21, 2020, 8:33am UTC](https://discuss.elastic.co/t/conditional-statement-not-working-in-filter/215817/4 "2020-01-21T08:33:05Z")
```auto { "log" => { "file" => { "path" => "C:\\Users\\Charles\\Desktop\\DATA\\asdf" }, "offset" => 209 }, "@timestamp" => 2020-01-21T08:12:40.466Z, "EXT" => "3513", "message" => "[2020-01-09 08:32:46] VERBOSE[18962][C-0000ceae] pbx.c: Executing [s-BUSY@macro-dialout-trunk:1] NoOp(\"PJSIP/3513-0001108e\", \"Dial failed due to trunk reporting BUSY - giving up\") in new stack", "TARGET" => "s-BUSY", "dialplan_context" => "macro-dialout-trunk", "protocol" => "PJSIP", "log_level" => "VERBOSE", "host" => { "name" => "D-ESS2018070164" }, "problem1" => "Dial failed due to trunk reporting BUSY ", "call_thread_id" => "C-0000ceae", "receiver_timestamp" => "2020-01-21T08:12:40.466Z", "action" => "Executing", "channel" => "0001108e", "problem2" => "giving up", "tags" => [ [0] "beats_input_codec_plain_applied" ], "@version" => "1", "agent" => { "id" => "6098a674-5dd7-4424-9fd9-848442bac485", "version" => "7.4.2", "type" => "filebeat", "ephemeral_id" => "d81d3c2a-d15c-4e78-8083-a948a2930d5e", "hostname" => "D-ESS2018070164" }, "dialplan_priority" => "1", "thread_id" => "18962", "log_message" => "NoOp(\"PJSIP/3513-0001108e\", \"Dial failed due to trunk reporting BUSY - giving up\") in new stack", "all" => "in new stack", "log_timestamp" => "2020-01-09 08:32:46", "process_name" => "asterisk_failed", "asterisk_app" => "NoOp", "ecs" => { "version" => "1.1.0" }, "module_name" => "pbx.c" } i just do something, the time i said it failed it really failed because i use the whole data, but ofcourse it contains one of those target. and still the condition not working at all. But when i try only using my target log. It works, it get into the conditional. can you explain this to me? I only created the filter for my target, there are actually a lot of shape logs but i didnt create their filter. ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 18, 2020, 8:33am UTC](https://discuss.elastic.co/t/conditional-statement-not-working-in-filter/215817/5 "2020-02-18T08:33:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.