# How to add multiple conditions in single if statement if ((A==1) && (B==( 2 || 3))

**URL:** <https://discuss.elastic.co/t/how-to-add-multiple-conditions-in-single-if-statement-if-a-1-b-2-3/212103>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [December 17, 2019, 6:41am UTC](https://discuss.elastic.co/t/how-to-add-multiple-conditions-in-single-if-statement-if-a-1-b-2-3/212103 "2019-12-17T06:41:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abdulrahman\_Batis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdulrahman_batis/32/59510_2.png) [@Abdulrahman\_Batis](https://discuss.elastic.co/u/Abdulrahman_Batis)\
**Post date:** [December 17, 2019, 6:41am UTC](https://discuss.elastic.co/t/how-to-add-multiple-conditions-in-single-if-statement-if-a-1-b-2-3/212103/1 "2019-12-17T06:41:23Z")

</div>

I want to add tags to some known issue to make it easier to identified as known issue

what we want to do is to add tag to logs messages only if that message came from 2 or 3 different process ,  
for example:

```
if "error opening socket: timeout" in [message] and [host] == "host111" {
      mutate { add_tag => "known-issue-Ticket:OPD-2232" }
  }

```

This Works fine but if I want to catch same error from another host:

```
  if "error opening socket: timeout" in [message] and [host] == "host111" OR "host222" {
       mutate { add_tag => "known-issue-Ticket:OPD-2232" }
  }

```

The bove didnt work

also tried the below

```
 if "error opening socket: timeout" in [message] and [host] == ["host111" OR "host222"] {

       mutate { add_tag => "known-issue-Ticket:OPD-2232" }
  }

if "error opening socket: timeout" in [message] and [host] == ("host111" OR "host222") {
      mutate { add_tag => "known-issue-Ticket:OPD-2232" }
 }

   if "error opening socket: timeout" in [message] and [host] == ["host111" || "host222"] {
       mutate { add_tag => "known-issue-Ticket:OPD-2232" }
   }

```

In the documentation it gives similar example but not same

> **[Accessing event data and fields | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)**

Here it is only if A==1 and B==2 then .....

> if [loglevel] == "ERROR" and [deployment] == "production" {  
> pagerduty {  
> ...  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\
**Post date:** [December 17, 2019, 6:48am UTC](https://discuss.elastic.co/t/how-to-add-multiple-conditions-in-single-if-statement-if-a-1-b-2-3/212103/2 "2019-12-17T06:48:14Z")

</div>

Hi

I suspect the syntax should be something like

```auto
if "error opening socket: timeout" in [message] and ([host] == "host111" or [host] == "host222") {

```

Hope this helps

---

<div class="post-metadata">

**Author:** ![Abdulrahman\_Batis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdulrahman_batis/32/59510_2.png) [@Abdulrahman\_Batis](https://discuss.elastic.co/u/Abdulrahman_Batis)\
**Post date:** [December 17, 2019, 7:07am UTC](https://discuss.elastic.co/t/how-to-add-multiple-conditions-in-single-if-statement-if-a-1-b-2-3/212103/3 "2019-12-17T07:07:58Z")

</div>

It Workssss Thank you so much .

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 17, 2019, 2:56pm UTC](https://discuss.elastic.co/t/how-to-add-multiple-conditions-in-single-if-statement-if-a-1-b-2-3/212103/4 "2019-12-17T14:56:26Z")

</div>

You can use a test for array membership, which is more compact.

```
[host] in ["host111", "host222", "host3"]
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2020, 2:56pm UTC](https://discuss.elastic.co/t/how-to-add-multiple-conditions-in-single-if-statement-if-a-1-b-2-3/212103/5 "2020-01-14T14:56:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.