# Filter help please! **URL:** \ **Category:** Logstash\ **Created:** [April 18, 2019, 7:28pm UTC](https://discuss.elastic.co/t/filter-help-please/177532 "2019-04-18T19:28:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Tim\_Flowers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_flowers/32/18081_2.png) [@Tim\_Flowers](https://discuss.elastic.co/u/Tim_Flowers)\ **Post date:** [April 18, 2019, 7:28pm UTC](https://discuss.elastic.co/t/filter-help-please/177532/1 "2019-04-18T19:28:46Z")
I am banging my head on something and I am hoping that someone can help me out. I am also open to better ways to do what I am doing if anyone has any ideas. Currently I get logs from multiple systems that I am trying to store in different indexes. I currently want to use 4 different indexes, coresystem, auxsystem, test\_sys, unknown. I was using indexes, coresystem, unknown fine, however when I added 3 things broke and I am just getting unknown for the new one I added. After adding test\_sys the data did not start to go to the new index, it is still going to the unknown index. filter { if [host] in ["10.10.252.99", "10.145.10.133", "10.145.25.7"] { mutate { add\_tag =\> ["coresystem"] add\_field =\> { "system\_type" =\> "coresystem" } } } } filter { if [host] == ["10.15.28.185"] { mutate { add\_tag =\> ["auxsystem"] add\_field =\> { "system\_type" =\> "auxsystem" } } } } filter { if "test\_sys" in [message] { mutate { add\_tag =\> ["test\_sys"] add\_field =\> { "system\_type" =\> "test" } replace =\> { "host" =\> "TestSys" } } } } filter { if [tags] == { mutate { add\_tag =\> ["unknown"] add\_field =\> { "system\_type" =\> "unknown" } } } } output { elasticsearch { hosts =\> ["localhost:9200"] manage\_template =\> false index =\> "%{system\_type}-%{+YYYY.MM.dd}" } } Thanks for the help! ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [April 18, 2019, 7:38pm UTC](https://discuss.elastic.co/t/filter-help-please/177532/2 "2019-04-18T19:38:54Z")
I will have done similier thing. I will put everything in to one filter. filter { if { } else if { } else if { } else { } }# end of filter section ---
**Author:** ![Tim\_Flowers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_flowers/32/18081_2.png) [@Tim\_Flowers](https://discuss.elastic.co/u/Tim_Flowers)\ **Post date:** [April 18, 2019, 7:39pm UTC](https://discuss.elastic.co/t/filter-help-please/177532/3 "2019-04-18T19:39:58Z")
I was using else if with the same result, I can try again though. ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [April 18, 2019, 7:42pm UTC](https://discuss.elastic.co/t/filter-help-please/177532/4 "2019-04-18T19:42:13Z")
Something like this filter { if [host] in ["10.10.252.99", "10.145.10.133", "10.145.25.7"] { mutate { add\_tag =\> ["coresystem"] add\_field =\> { "system\_type" =\> "coresystem" } } } if [host] == ["10.15.28.185"] { mutate { add\_tag =\> ["auxsystem"] add\_field =\> { "system\_type" =\> "auxsystem" } } } if "test\_sys" in [message] { mutate { add\_tag =\> ["test\_sys"] add\_field =\> { "system\_type" =\> "test" } replace =\> { "host" =\> "TestSys" } } } ``` if [tags] == { mutate { add_tag => ["unknown"] add_field => { "system_type" => "unknown" } } } ``` } ---
**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Post date:** [April 18, 2019, 7:47pm UTC](https://discuss.elastic.co/t/filter-help-please/177532/5 "2019-04-18T19:47:06Z")
``` ### job_status will be 0,1,2,3,4,5 lets put some meaning to it if [job_status] == "0" { mutate { add_field => { "status" => "queued" } } #Mutate }else if [job_status] == "1" { mutate { add_field => { "status" => "active" } } #Mutate } else if [job_status] == "2" { mutate { add_field => { "status" => "waiting_resource" } } #Mutate } else if [job_status] == "3" { mutate { add_field => { "status" => "success" } } #Mutate } else if [job_status] == "4" { mutate { add_field => { "status" => "suspended" } } #Mutate } else if [job_status] == "5" { mutate { add_field => { "status" => "incomplete" } } #Mutate } else { mutate { add_field => { "status" => "unknown" } } #Mutate } ``` Here is example that I am using and it is working fine. ---
**Author:** ![Tim\_Flowers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_flowers/32/18081_2.png) [@Tim\_Flowers](https://discuss.elastic.co/u/Tim_Flowers)\ **Post date:** [April 18, 2019, 8:21pm UTC](https://discuss.elastic.co/t/filter-help-please/177532/6 "2019-04-18T20:21:57Z")
I have changed them back to else if statements and I am waiting for some data to hit the logs now. ---
**Author:** ![Tim\_Flowers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_flowers/32/18081_2.png) [@Tim\_Flowers](https://discuss.elastic.co/u/Tim_Flowers)\ **Post date:** [April 18, 2019, 8:46pm UTC](https://discuss.elastic.co/t/filter-help-please/177532/7 "2019-04-18T20:46:59Z")
So I went back and it is working now, now sure why...Must have had a strange typo, thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 16, 2019, 8:47pm UTC](https://discuss.elastic.co/t/filter-help-please/177532/8 "2019-05-16T20:47:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.