# Conditional statements in logstash.conf **URL:** \ **Category:** Logstash\ **Created:** [July 24, 2019, 5:58pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108 "2019-07-24T17:58:24Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![griffer98](https://avatars.discourse-cdn.com/v4/letter/g/e8c25b/32.png) [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Post date:** [July 24, 2019, 5:58pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/1 "2019-07-24T17:58:24Z")
I am parsing xml documents but there are different types with different names. Each type of document has different tags so each document will require different xpath expressions. What I want to do is write a conditional statement that basically says, if the source filename from the source has this structure, then use these xpath expressions, else if the filename has a different structure, use these xpath expressions. Is this possible in logstash? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 24, 2019, 6:09pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/2 "2019-07-24T18:09:35Z")
If the [source] field contains the file path and name then you could use ``` if [source] =~ /foo.xml/ { xml { [...] } } else if [source] =~ /bar.xml/ { xml { [...] } } ``` ---
**Author:** ![griffer98](https://avatars.discourse-cdn.com/v4/letter/g/e8c25b/32.png) [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Post date:** [July 24, 2019, 6:10pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/3 "2019-07-24T18:10:49Z")
can I use a regular expression to describe the pattern of the filename instead of saying foo.xml? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 24, 2019, 6:37pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/4 "2019-07-24T18:37:29Z")
Yes. Everything inside the / and / is matched as a regexp. ---
**Author:** ![griffer98](https://avatars.discourse-cdn.com/v4/letter/g/e8c25b/32.png) [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Post date:** [July 31, 2019, 2:34pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/5 "2019-07-31T14:34:52Z")
It seems to not be working. Does the regular expression need to be in quotes? Does it need to be like /'regular expression'/? because I cant get it to catch anything even through the expression does work. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 31, 2019, 2:40pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/6 "2019-07-31T14:40:31Z")
The regexp should not be quoted in either single or double quotes, just wrapped in // ---
**Author:** ![griffer98](https://avatars.discourse-cdn.com/v4/letter/g/e8c25b/32.png) [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Post date:** [August 6, 2019, 2:15pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/7 "2019-08-06T14:15:53Z")
Ive tried multipple but I cant get it to work. it keeps skipping the first if statement. My regular expression is correct. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 6, 2019, 2:43pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/8 "2019-08-06T14:43:18Z")
What does your if statement look like and what does the event look like? ---
**Author:** ![griffer98](https://avatars.discourse-cdn.com/v4/letter/g/e8c25b/32.png) [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Post date:** [August 6, 2019, 5:50pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/9 "2019-08-06T17:50:27Z")
It's an xml document and I am just trying to test the file name. There is sensitive information in the regular expression so I will replace any of that with "some word" or "some expression" ``` if [source] =~ /someword_\d{2,3}_someword\d{1}_CH\d_\S{1,3}\d{0,1}_GO-\d{10}_\d{0,2}-\D{3}-\d{4}_\d{6}.xml/ { xml { source => "message" xpath => [ Some expression that is correct. ] store_xml => false force_array => false } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 6, 2019, 5:57pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/10 "2019-08-06T17:57:24Z")
The if statement looks OK. If I run ``` input { generator { count => 1 lines => [''] } } filter { mutate { add_field => { "source" => "someword_12_someword0_CH1_AbC_GO-0123456789_-;;;-1234_123456.xml" } } if [source] =~ /someword_\d{2,3}_someword\d{1}_CH\d_\S{1,3}\d{0,1}_GO-\d{10}_\d{0,2}-\D{3}-\d{4}_\d{6}.xml/ { mutate { add_field => { "matched" => true } } } } ``` then the [matched] field does get added. ---
**Author:** ![griffer98](https://avatars.discourse-cdn.com/v4/letter/g/e8c25b/32.png) [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Post date:** [August 6, 2019, 6:35pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/11 "2019-08-06T18:35:22Z")
even if I use the exact file name instead of the regular expression, it still doesnt catch and doesnt parse throught the xml as if the conditional failed. Also, for some reason, when I review my results in kibana, the source field that usually contains the file name isnt showing up. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 3, 2019, 6:35pm UTC](https://discuss.elastic.co/t/conditional-statements-in-logstash-conf/192108/12 "2019-09-03T18:35:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.