# Filebeat If Statement Ingest Processor not Working

**URL:** <https://discuss.elastic.co/t/filebeat-if-statement-ingest-processor-not-working/218685>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 10, 2020, 11:00pm UTC](https://discuss.elastic.co/t/filebeat-if-statement-ingest-processor-not-working/218685 "2020-02-10T23:00:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![savethebyte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/savethebyte/32/62742_2.png) [@savethebyte](https://discuss.elastic.co/u/savethebyte)\
**Post date:** [February 10, 2020, 11:00pm UTC](https://discuss.elastic.co/t/filebeat-if-statement-ingest-processor-not-working/218685/1 "2020-02-10T23:00:20Z")

</div>

Hello,

I am trying to map an IP address to a hostname with an If statement on an ingest pipeline.  
These IPs are not in DNS and need to have a hostname associated to them for reporting.

If I remove the "if" statement, the set processor works fine. I have tried variations on matching with If: and am not having any luck.

This is using the NetFlow module for Filebeats.

```
  "filebeat-7.5.2-netflow-log-pipeline" : {
    "description" : "Pipeline for Filebeat NetFlow",
    "processors" : [
      {
        "geoip" : {
          "if" : "ctx.source?.geo == null",
          "field" : "source.ip",
          "target_field" : "source.geo",
          "ignore_missing" : true
        }
      },
      {
        "geoip" : {
          "field" : "destination.ip",
          "target_field" : "destination.geo",
          "ignore_missing" : true,
          "if" : "ctx.destination?.geo == null"
        }
      },
      {
        "geoip" : {
          "database_file" : "GeoLite2-ASN.mmdb",
          "field" : "source.ip",
          "target_field" : "source.as",
          "properties" : [
            "asn",
            "organization_name"
          ],
          "ignore_missing" : true
        }
      },
      {
        "geoip" : {
          "properties" : [
            "asn",
            "organization_name"
          ],
          "ignore_missing" : true,
          "database_file" : "GeoLite2-ASN.mmdb",
          "field" : "destination.ip",
          "target_field" : "destination.as"
        }
      },
      {
        "rename" : {
          "field" : "source.as.asn",
          "target_field" : "source.as.number",
          "ignore_missing" : true
        }
      },
      {
        "rename" : {
          "ignore_missing" : true,
          "field" : "source.as.organization_name",
          "target_field" : "source.as.organization.name"
        }
      },
      {
        "rename" : {
          "target_field" : "destination.as.number",
          "ignore_missing" : true,
          "field" : "destination.as.asn"
        }
      },
      {
        "rename" : {
          "field" : "destination.as.organization_name",
          "target_field" : "destination.as.organization.name",
          "ignore_missing" : true
        }
      },
      {
        "set" : {
          "if" : "observer.ip == X.X.X.X",
          "field" : "observer.hostname",
          "value" : "HOSTNAME-HERE"
        }
      }
    ],
    "on_failure" : [
      {
        "set" : {
          "value" : "{{ _ingest.on_failure_message }}",
          "field" : "error.message"
        }
      }
    ]
  }

```

Thanks,

Jake

---

<div class="post-metadata">

**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\
**Post date:** [February 11, 2020, 9:11am UTC](https://discuss.elastic.co/t/filebeat-if-statement-ingest-processor-not-working/218685/2 "2020-02-11T09:11:13Z")

</div>

Hi Jake,

What is the error message you see when the condition is enabled?  
Also, have you tried:

```auto
"if": "ctx.observer?.ip == 'x.x.x.x'",

```

---

<div class="post-metadata">

**Author:** ![savethebyte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/savethebyte/32/62742_2.png) [@savethebyte](https://discuss.elastic.co/u/savethebyte)\
**Post date:** [February 11, 2020, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-if-statement-ingest-processor-not-working/218685/3 "2020-02-11T16:05:32Z")

</div>

Thank you Mariana!

I was having two issues. I was not using ctx correctly. Initially, I had ctx.\_source.observer.ip rather than ctx.observer?.ip

Second, I did not have the single quotes around the IP address. The final solution was like this:

```
  {
    "set" : {
      "if" : "ctx.observer?.ip == 'X.X.X.X'",
      "field" : "observer.hostname",
      "value" : "HOSTNAME-HERE"
    }
  }

```

Thanks again for your assistance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2020, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-if-statement-ingest-processor-not-working/218685/4 "2020-03-10T16:05:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.