# Error in Logstash conditional expression

**URL:** <https://discuss.elastic.co/t/error-in-logstash-conditional-expression/118322>\
**Category:** Logstash\
**Created:** [February 3, 2018, 9:49pm UTC](https://discuss.elastic.co/t/error-in-logstash-conditional-expression/118322 "2018-02-03T21:49:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamsaurabhrk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iamsaurabhrk/32/94219_2.png) [@iamsaurabhrk](https://discuss.elastic.co/u/iamsaurabhrk)\
**Post date:** [February 3, 2018, 9:49pm UTC](https://discuss.elastic.co/t/error-in-logstash-conditional-expression/118322/1 "2018-02-03T21:49:58Z")

</div>

I am using Logstash 5.5.0. I have the following configuration:

```
input { stdin { } }

filter {
  grok {
    match => { "message" => "^(%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:LogLevel}%{SPACE}(?:\[)%{NOTSPACE:ThreadName}(?:\]))?%{SPACE}%{GREEDYDATA:msg}%{SPACE}" }
    if [message] =~ "Exception" or [message] =~ "exception" {
    add_field => { "logtype" => "Exception" }
    }
    else if [message] =~ "ERROR" or [message] =~ "error" {
    add_field => { "logtype" => "Error" }
    }     
    else {
    add_field => { "logtype" => "General" }
    }
  }
}

output {
  stdout { codec => rubydebug }
}

```

This configuration is giving me the following error on invoking logstash with config.test\_and\_exit option:

```
[LogStash::Runner] FATAL logstash.runner - The given configuration is invalid. Reason: Expected one of #, => at line 6, column 8 (byte 217) after filter {
  grok {
    match => { "message" => "^(%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:LogLevel}%{SPACE}(?:\[)%{NOTSPACE:ThreadName}(?:\]))?%{SPACE}%{GREEDYDATA:msg}%{SPACE}" }
    if 

```

What is it that I am doing wrong?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 3, 2018, 10:03pm UTC](https://discuss.elastic.co/t/error-in-logstash-conditional-expression/118322/2 "2018-02-03T22:03:08Z")

</div>

You can not have conditional statements within a filter.

---

<div class="post-metadata">

**Author:** ![iamsaurabhrk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iamsaurabhrk/32/94219_2.png) [@iamsaurabhrk](https://discuss.elastic.co/u/iamsaurabhrk)\
**Post date:** [February 4, 2018, 1:41pm UTC](https://discuss.elastic.co/t/error-in-logstash-conditional-expression/118322/3 "2018-02-04T13:41:15Z")

</div>

Can you please suggest a configuration that I can use to achieve what I am trying to do?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 4, 2018, 2:56pm UTC](https://discuss.elastic.co/t/error-in-logstash-conditional-expression/118322/4 "2018-02-04T14:56:07Z")

</div>

Something like this should do it:

```
filter {
  grok {
    match => { "message" => "^(%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:LogLevel}%{SPACE}(?:\[)%{NOTSPACE:ThreadName}(?:\]))?%{SPACE}%{GREEDYDATA:msg}%{SPACE}" }
  }

  if [message] =~ "Exception" or [message] =~ "exception" {
    mutate {  
      add_field => { "logtype" => "Exception" }
    }
  } else if [message] =~ "ERROR" or [message] =~ "error" {
    mutate {    
      add_field => { "logtype" => "Error" }
    }
  } else {
    mutate {
      add_field => { "logtype" => "General" }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![iamsaurabhrk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iamsaurabhrk/32/94219_2.png) [@iamsaurabhrk](https://discuss.elastic.co/u/iamsaurabhrk)\
**Post date:** [February 8, 2018, 9:21am UTC](https://discuss.elastic.co/t/error-in-logstash-conditional-expression/118322/5 "2018-02-08T09:21:38Z")

</div>

Works perfectly! Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2018, 9:21am UTC](https://discuss.elastic.co/t/error-in-logstash-conditional-expression/118322/6 "2018-03-08T09:21:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.