# Filters

**URL:** <https://discuss.elastic.co/t/filters/264644>\
**Category:** Logstash\
**Created:** [February 18, 2021, 5:12am UTC](https://discuss.elastic.co/t/filters/264644 "2021-02-18T05:12:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anu6006](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Anu6006](https://discuss.elastic.co/u/Anu6006)\
**Post date:** [February 18, 2021, 5:12am UTC](https://discuss.elastic.co/t/filters/264644/1 "2021-02-18T05:12:18Z")

</div>

![nsg.PNG](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e356811a12c52ba661031bce149b8dc2384f65e6.jpeg)

Hi Team,

In logstash the filters are not working. The data is coming from azure blob storage.

filter {

```
split {

    field => "[records]"

}

split {

    field => "[records][properties][flows]"

}

split {

    field => "[records][properties][flows][flows]"

}

split {

    field => "[records][properties][flows][flows][flowTuples]"

}

mutate {

    split => {

        "[records][resourceId]" => "/"

    }

    add_field => {

        "Subscription" => "%{[records][resourceId][2]}"

        "ResourceGroup" => "%{[records][resourceId][4]}"

        "NetworkSecurityGroup" => "%{[records][resourceId][8]}"

    }

    convert => {

        "Subscription" => "string"

    }

    convert => {

        "ResourceGroup" => "string"

    }

    convert => {

        "NetworkSecurityGroup" => "string"

    }

    split => {

        "[records][properties][flows][flows][flowTuples]" => ","

    }

    add_field => {

        "unixtimestamp" => "%{[records][properties][flows][flows][flowTuples][0]}"

        "srcIp" => "%{[records][properties][flows][flows][flowTuples][1]}"

        "destIp" => "%{[records][properties][flows][flows][flowTuples][2]}"

        "srcPort" => "%{[records][properties][flows][flows][flowTuples][3]}"

        "destPort" => "%{[records][properties][flows][flows][flowTuples][4]}"

        "protocol" => "%{[records][properties][flows][flows][flowTuples][5]}"

        "trafficflow" => "%{[records][properties][flows][flows][flowTuples][6]}"

        "traffic" => "%{[records][properties][flows][flows][flowTuples][7]}"

    }

    convert => {

        "unixtimestamp" => "integer"

    }

    convert => {

        "srcPort" => "integer"

    }

    convert => {

        "destPort" => "integer"

    }

}

date {

    match => ["unixtimestamp", "UNIX"]

```

}  
}

What should I change to make sure that the data will be filtered properly?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2021, 5:12am UTC](https://discuss.elastic.co/t/filters/264644/2 "2021-03-18T05:12:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.