# Grok Expression in If condition Filter

**URL:** <https://discuss.elastic.co/t/grok-expression-in-if-condition-filter/58615>\
**Category:** Logstash\
**Created:** [August 22, 2016, 8:34pm UTC](https://discuss.elastic.co/t/grok-expression-in-if-condition-filter/58615 "2016-08-22T20:34:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kamesh](https://avatars.discourse-cdn.com/v4/letter/k/34f0e0/32.png) [@kamesh](https://discuss.elastic.co/u/kamesh)\
**Post date:** [August 22, 2016, 8:34pm UTC](https://discuss.elastic.co/t/grok-expression-in-if-condition-filter/58615/1 "2016-08-22T20:34:01Z")

</div>

Is it possible to use Grok Expression with in If condition

i.e.

filter  
{  
if ([message] = /^%{TIMESTAMP\_ISO8601}) (i.e. if line starts with ISO8601 Timestamp it needs to execute different condition)  
{  
grok (some condition)  
}  
else if ([message] = /^%{CATALINA\_DATESTAMP}) (i.e. if line starts with CATALINA data time format, it needs to execute different condition)  
{  
grok(some condition)  
}

I tried this condition, however I am not getting expected result at the same time I am not getting any error.

Thanks,  
Kamesh.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 23, 2016, 5:56am UTC](https://discuss.elastic.co/t/grok-expression-in-if-condition-filter/58615/2 "2016-08-23T05:56:45Z")

</div>

> Is it possible to use Grok Expression with in If condition

No, it is not.

> I tried this condition, however I am not getting expected result at the same time I am not getting any error.

Why would you get an error? The string is still a valid regular expression, it's just that it doesn't match like you expect it to.

(But if grok patterns in regexp match expressions _did_ work, the fact that you're escaping the percent sign at the beginning of the string probably would've prevented it from working.)

---

<div class="post-metadata">

**Author:** ![kamesh](https://avatars.discourse-cdn.com/v4/letter/k/34f0e0/32.png) [@kamesh](https://discuss.elastic.co/u/kamesh)\
**Post date:** [August 23, 2016, 9:38pm UTC](https://discuss.elastic.co/t/grok-expression-in-if-condition-filter/58615/3 "2016-08-23T21:38:04Z")

</div>

Got it, thanks. Now, I am using the same condition in grok filter:

input  
{  
file  
{  
path =\> "/tmp/osb\_server.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
codec =\> multiline  
{  
pattern =\> "(^####)|(^[%{TIMESTAMP\_ISO8601})|(^\<%{CATALINA\_DATESTAMP})|(^%{YEAR}-%{MONTHNUM}-%{MONTHDAY})"  
negate =\> "true"  
what =\> previous  
}  
type =\> "osb\_server.log"  
}  
}  
filter  
{  
grok  
{  
match =\> ["message", "(?^#.{3})",  
"message", "^[%{TIMESTAMP\_ISO8601:logType2}]",  
"message", "^\<%{CATALINA\_DATESTAMP:logType3}",  
"message", "(?\<logType4\>^%{YEAR}-%{MONTHNUM}-%{MONTHDAY})"]  
break\_on\_match =\> false  
tag\_on\_failure =\> []  
}  
mutate  
{  
remove\_field =\> ["@version"]  
}  
}  
output {  
elasticsearch {  
hosts =\> ["192.168.99.100:9200"]  
}  
stdout { codec =\> rubydebug }  
}

Is this the right approach? i get different types of logs and I am using the same configuration file, whenever it sees a line starting with any of the above condition provided then it needs to create the variables accordingly. Based on the variables I am planning to write conditions.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 24, 2016, 6:10am UTC](https://discuss.elastic.co/t/grok-expression-in-if-condition-filter/58615/4 "2016-08-24T06:10:45Z")

</div>

Yes, this looks reasonable. I'm assuming your multiline pattern actually contains `\|` and not just `|`. **Always** post your configuration formatted as code to avoid this kind of time-wasting ambiguity.

---

<div class="post-metadata">

**Author:** ![kamesh](https://avatars.discourse-cdn.com/v4/letter/k/34f0e0/32.png) [@kamesh](https://discuss.elastic.co/u/kamesh)\
**Post date:** [August 24, 2016, 2:14pm UTC](https://discuss.elastic.co/t/grok-expression-in-if-condition-filter/58615/5 "2016-08-24T14:14:52Z")

</div>

Thanks, I will.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/grok-expression-in-if-condition-filter/58615/6 "2017-07-06T04:41:51Z")

</div>