# Conditionals within filter using fields generated by cloudwatch logs plugin

**URL:** <https://discuss.elastic.co/t/conditionals-within-filter-using-fields-generated-by-cloudwatch-logs-plugin/140609>\
**Category:** Logstash\
**Created:** [July 18, 2018, 7:09pm UTC](https://discuss.elastic.co/t/conditionals-within-filter-using-fields-generated-by-cloudwatch-logs-plugin/140609 "2018-07-18T19:09:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vacovsky](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@vacovsky](https://discuss.elastic.co/u/vacovsky)\
**Post date:** [July 18, 2018, 7:09pm UTC](https://discuss.elastic.co/t/conditionals-within-filter-using-fields-generated-by-cloudwatch-logs-plugin/140609/1 "2018-07-18T19:09:02Z")

</div>

I'm having an issue getting my grok filter to apply to VPC logs, and hoping someone here can help.

```
filter {
    if "vpc-logs" in [cloudwatch_logs.log_group] {
        grok {
            patterns_dir => ["/etc/logstash/patterns/"]
            match => {"message" => "%{VPCFLOWLOG}"}
        }
    }
}

```

If I remove the "[cloudwatch\_logs.log\_group]" section and set it equal to a matching string (in this case: "aws-vpc-logs"), everything works fine, but the "cloudwatch\_logs.log\_group" field is generated by the input plugin I'm using. I'd like to do substring matching on this field to select the grok parser by name for each type of logs, using the AWS Cloudwatch Logs log group path as a determining factor. It seems as though the substring matching never passes the check.

Conversely, if I

I'd really like to be able to base my filter on a substring of the Cloudwatch Logs log\_group name, for the sake of my sanity, and reducing complexity in the Logstash configurations I'm making.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 18, 2018, 7:30pm UTC](https://discuss.elastic.co/t/conditionals-within-filter-using-fields-generated-by-cloudwatch-logs-plugin/140609/2 "2018-07-18T19:30:53Z")

</div>

Do you mean [cloudwatch][log\_group] or do you really have a dot in the field name?

---

<div class="post-metadata">

**Author:** ![vacovsky](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@vacovsky](https://discuss.elastic.co/u/vacovsky)\
**Post date:** [July 18, 2018, 8:10pm UTC](https://discuss.elastic.co/t/conditionals-within-filter-using-fields-generated-by-cloudwatch-logs-plugin/140609/3 "2018-07-18T20:10:24Z")

</div>

Wow. Yes! That's exactly what I was doing wrong. Ditched the dot for your syntax and it started working.

For clarity: changed

`if "vpc-logs" in [cloudwatch_logs.log_group] {`

to

`if "vpc-logs" in [cloudwatch_logs][log_group] {`

Thanks very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2018, 8:10pm UTC](https://discuss.elastic.co/t/conditionals-within-filter-using-fields-generated-by-cloudwatch-logs-plugin/140609/4 "2018-08-15T20:10:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.