# Filter does not work properly

**URL:** <https://discuss.elastic.co/t/filter-does-not-work-properly/289039>\
**Category:** Logstash\
**Created:** [November 12, 2021, 5:06am UTC](https://discuss.elastic.co/t/filter-does-not-work-properly/289039 "2021-11-12T05:06:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![111435](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111435/32/81005_2.png) [@111435](https://discuss.elastic.co/u/111435)\
**Post date:** [November 12, 2021, 5:06am UTC](https://discuss.elastic.co/t/filter-does-not-work-properly/289039/1 "2021-11-12T05:06:07Z")

</div>

I have this filter:

```auto
filter {

mutate {
convert => {"ticket_fields" => "string"
"tags" => "string"}
}

mutate {

        rename => { "tags" => "category" }
      }

if "неактивность" in [category] {

if "Диалог не состоялся" in [category] {
grok { match => {"category" => "%{GREEDYDATA}Диалог не состоялся:%{GREEDYDATA:category2}:%{GREEDYDATA:category3}\"%{GREEDYDATA},%{GREEDYDATA}"}}
mutate { add_field => {"category1" => "Диалог не состоялся"}}
}

else if "Консультация" in [category] {
grok { match => {"category" => "%{GREEDYDATA}Консультация:%{GREEDYDATA:category2}:%{GREEDYDATA:category3}\"%{GREEDYDATA},%{GREEDYDATA}"}}
mutate { add_field => {"category1" => "Консультация"}}
}

else if "Проблема" in [category] {
grok { match => {"category" => "%{GREEDYDATA}Проблема:%{GREEDYDATA:category2}:%{GREEDYDATA:category3}\"%{GREEDYDATA},%{GREEDYDATA}"}}
mutate { add_field => {"category1" => "Проблема"}}
}

}

else {

if "Диалог не состоялся" in [category] {
grok { match => {"category" => "%{GREEDYDATA}Диалог не состоялся:%{GREEDYDATA:category2}:%{GREEDYDATA:category3}\"%{GREEDYDATA}"}}
mutate { add_field => {"category1" => "Диалог не состоялся"}}
}

else if "Консультация" in [category] {
grok { match => {"category" => "%{GREEDYDATA}Консультация:%{GREEDYDATA:category2}:%{GREEDYDATA:category3}\"%{GREEDYDATA}"}}
mutate { add_field => {"category1" => "Консультация"}}
}

else if "Проблема" in [category] {
grok { match => {"category" => "%{GREEDYDATA}Проблема:%{GREEDYDATA:category2}:%{GREEDYDATA:category3}\"%{GREEDYDATA}"}}
mutate { add_field => {"category1" => "Проблема"}}
}
}
}

```

But in Elasticsearch I do not have parsed fields category1, category2, category3

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a0564b2432b806eecce5c01baeba4a559f9ba477.png)

and logstash logs have no errors.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 12, 2021, 5:47pm UTC](https://discuss.elastic.co/t/filter-does-not-work-properly/289039/2 "2021-11-12T17:47:43Z")

</div>

If there is only one "name" that contains three colon separated fields I would use the more compact

```
if "неактивность" in [category] {
    grok { match => { "category" => '"name"=>"(?<category1>(Диалог не состоялся|Консультация|Проблема)):(?<category2>[^:]+):(?<category3>[^:]+)"' } }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2021, 5:48pm UTC](https://discuss.elastic.co/t/filter-does-not-work-properly/289039/3 "2021-12-10T17:48:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.