# Filters not working after split

**URL:** <https://discuss.elastic.co/t/filters-not-working-after-split/55242>\
**Category:** Logstash\
**Created:** [July 11, 2016, 10:30pm UTC](https://discuss.elastic.co/t/filters-not-working-after-split/55242 "2016-07-11T22:30:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)\
**Post date:** [July 11, 2016, 10:30pm UTC](https://discuss.elastic.co/t/filters-not-working-after-split/55242/1 "2016-07-11T22:30:06Z")

</div>

I have F5 appliances sending multiple events, so use a split filter to separate these before parsing them.

The first grok filter I apply works, but any subsequent filters fail.

This is the working filter, with the match statement abbreviated:

filter {

## F5 High Speed Logging

```
    if [type] == "hsl_f5" {
	split {
	}
	grok {
		patterns_dir => "/opt/logstash/patterns"
		match => ["message", "....."]
		add_tag => "grokked_hsl_f5"
	}
}

```

}

If I add a statement within the grok {} section, to add a second tag for example , it works. e.g.

```
	grok {
		patterns_dir => "/opt/logstash/patterns"
		match => ["message", "....."]
		add_tag => "grokked_hsl_f5"
                   add_tag => "test_tag"
	}

```

If I try to anything to the filter outside that grok {} section it is either ignored or logstash stops processing the events at all. e.g.

## F5 High Speed Logging

```
    if [type] == "hsl_f5" {
	split {
	}
	grok {
		patterns_dir => "/opt/logstash/patterns"
		match => ["message", "....."]
		add_tag => "grokked_hsl_f5"
	}
	geoip {
		source => "client_ip"
		target => "geoip"
		database => "/etc/logstash/GeoLiteCity.dat"
		add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
		add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
	}
	mutate {
		convert => ["[geoip][coordinates]", "float"]
	}
}

```

}

Is this a consequence of the split {} operator? Am I missing something?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/filters-not-working-after-split/55242/2 "2017-07-06T04:48:35Z")

</div>

Closed on July 6, 2017, 4:48am UTC