# Field value filter

**URL:** <https://discuss.elastic.co/t/field-value-filter/95701>\
**Category:** Logstash\
**Created:** [August 3, 2017, 11:27am UTC](https://discuss.elastic.co/t/field-value-filter/95701 "2017-08-03T11:27:57Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![shaharz](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@shaharz](https://discuss.elastic.co/u/shaharz)\
**Post date:** [August 3, 2017, 11:27am UTC](https://discuss.elastic.co/t/field-value-filter/95701/1 "2017-08-03T11:27:57Z")

</div>

Hello,

i would like to know how can i do a field value filter? for example to do drop event by field value or length of a value, and how can i do a where in filter, for example. "field value" not in [1,2,3] etc.

thanks.

---

<div class="post-metadata">

**Author:** ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)\
**Post date:** [August 3, 2017, 11:33am UTC](https://discuss.elastic.co/t/field-value-filter/95701/2 "2017-08-03T11:33:55Z")

</div>

You could define the Grok pattern with conditional fields.

IF the pattern matches x - set the value to the a 'xstring'  
else you could set value to 'anotherstring'

Example  
%{patternforx:xstring}| %{WORD:ystring}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 3, 2017, 11:39am UTC](https://discuss.elastic.co/t/field-value-filter/95701/3 "2017-08-03T11:39:22Z")

</div>

Have you read the documentation about conditionals?

[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)

---

<div class="post-metadata">

**Author:** ![shaharz](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@shaharz](https://discuss.elastic.co/u/shaharz)\
**Post date:** [August 4, 2017, 2:04pm UTC](https://discuss.elastic.co/t/field-value-filter/95701/4 "2017-08-04T14:04:55Z")

</div>

thank you

---

<div class="post-metadata">

**Author:** ![shaharz](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@shaharz](https://discuss.elastic.co/u/shaharz)\
**Post date:** [August 4, 2017, 2:05pm UTC](https://discuss.elastic.co/t/field-value-filter/95701/5 "2017-08-04T14:05:15Z")

</div>

now yes :). thanks !

---

<div class="post-metadata">

**Author:** ![shaharz](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@shaharz](https://discuss.elastic.co/u/shaharz)\
**Post date:** [August 4, 2017, 2:19pm UTC](https://discuss.elastic.co/t/field-value-filter/95701/6 "2017-08-04T14:19:27Z")

</div>

tell me, didnt see how i can get the length of a field value?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 4, 2017, 2:20pm UTC](https://discuss.elastic.co/t/field-value-filter/95701/7 "2017-08-04T14:20:59Z")

</div>

I think you need to use a ruby filter to check the field value length.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2017, 2:21pm UTC](https://discuss.elastic.co/t/field-value-filter/95701/8 "2017-09-01T14:21:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.