# Config file that checks conditions before naming fields

**URL:** <https://discuss.elastic.co/t/config-file-that-checks-conditions-before-naming-fields/217253>\
**Category:** Logstash\
**Created:** [January 30, 2020, 5:42pm UTC](https://discuss.elastic.co/t/config-file-that-checks-conditions-before-naming-fields/217253 "2020-01-30T17:42:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![teezy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/teezy/32/47626_2.png) [@teezy](https://discuss.elastic.co/u/teezy)\
**Post date:** [January 30, 2020, 5:42pm UTC](https://discuss.elastic.co/t/config-file-that-checks-conditions-before-naming-fields/217253/1 "2020-01-30T17:42:55Z")

</div>

Hi, I have a secure log file with the following content:

```
Jan 12 08:28:24 name sshd[11483]: Did not receive identification string from xx.xxx.xxx.xx port xxxxx
Jan 12 08:38:54 name proftpd[12559]: xx.xxx.xxx.xx (xx.xxx.xxx.xx[xx.xxx.xxx.xx]) - USER word: no such user found from xx.xxx.xxx.xx [xx.xxx.xxx.xx] to ::ffff:xx.xxx.xxx.xx:21
Jan 12 10:13:47 name proftpd[24765]: xx.xxx.xxx.xx (xx.xxx.xxx.xx[xx.xxx.xxx.xx]) - USER word (Login failed): Incorrect password

```

As you can see, there's different kind of lines (not all the same pattern).  
I'm trying to write a config file that will only load the lines that contain 'Login failed'. Then, I need the date and time, IP, and inserted username. How do I check the lines for the presence of 'Login failed', and create field names after that, since there are no fields to begin with?

What I have now:

```
input {
    file {
        path => /home/name/secure/secure-log"
        start_position => "beginning" 
        sincedb_path => "/dev/null"
        }
}

filter {
  ...
}

output {
    elasticsearch {
        hosts => "localhost"
        index => "secure-logs"
        document_type => "secure-logs"
     }
     stdout {}   
}

```

So I'd like something like:

```
if 'Login failed' in line:
    seperator => " "
    columns => ["date", "time", "word", "ip", "ip2", "dash", "user", "username" ....]
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 30, 2020, 6:38pm UTC](https://discuss.elastic.co/t/config-file-that-checks-conditions-before-naming-fields/217253/2 "2020-01-30T18:38:30Z")

</div>

> [@teezy](#):
>
> How do I check the lines for the presence of 'Login failed'

You can do a substring match using

```
if "Login failed" in [message] {
    ...
}

```

---

<div class="post-metadata">

**Author:** ![teezy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/teezy/32/47626_2.png) [@teezy](https://discuss.elastic.co/u/teezy)\
**Post date:** [January 30, 2020, 6:50pm UTC](https://discuss.elastic.co/t/config-file-that-checks-conditions-before-naming-fields/217253/3 "2020-01-30T18:50:46Z")

</div>

But what is [message]? cause there are no specific fields I can look for since there are no fields to begin with. I also can't create fields before conditioning because every line has a different pattern.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 30, 2020, 7:41pm UTC](https://discuss.elastic.co/t/config-file-that-checks-conditions-before-naming-fields/217253/4 "2020-01-30T19:41:20Z")

</div>

> [@teezy](#):
>
> But what is [message]?

A file input will read each line from the file and for each line it creates an event with the text of the line in the [message] field.

---

<div class="post-metadata">

**Author:** ![teezy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/teezy/32/47626_2.png) [@teezy](https://discuss.elastic.co/u/teezy)\
**Post date:** [January 31, 2020, 10:01am UTC](https://discuss.elastic.co/t/config-file-that-checks-conditions-before-naming-fields/217253/5 "2020-01-31T10:01:06Z")

</div>

Hmm I'm not sure what you mean. Could you show an example?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2020, 10:01am UTC](https://discuss.elastic.co/t/config-file-that-checks-conditions-before-naming-fields/217253/6 "2020-02-28T10:01:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.