# How to determine if field contains a value?

**URL:** <https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842>\
**Category:** Logstash\
**Created:** [August 22, 2017, 3:46am UTC](https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842 "2017-08-22T03:46:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [August 22, 2017, 3:46am UTC](https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842/1 "2017-08-22T03:46:28Z")

</div>

Hello,

Here's my sample data in a field called "additional text"

"additionalText" : [  
"A "commonMIBAlarm" event has occurred, from xxxxxx device, named xxxxxx Severity=major ComponentID=Navigation System&Name=Navigation Site&Name=CS ......  
]

Now, what i wanted to accomplish is to parse few fields like severity, componentID using grok filter.

I have this in my filter,

```
if "commonMIBAlarm" in [additionalText] {
	grok {
		match => { "additionalText" => "%{GREEDYDATA:AddnlText_Status} Event Message: +%{GREEDYDATA:AddnlText_EventMessage} Description: +%{GREEDYDATA:AddnlText_Description} Severity = +%{GREEDYDATA:AddnlText_Severity} ComponentID = +%{GREEDYDATA:AddnlText_ComponentID} SourceIPAddress = +%{GREEDYDATA:AddnlText_SourceIPAddress} ErrCode = +%{GREEDYDATA:AddnlText_ErrCode} Alarm Data = +%{GREEDYDATA:AddnlText_AlarmData} Alarm Type = +%{GREEDYDATA:AddnlText_AlarmType} Probable Cause = +%{GREEDYDATA:AddnlText_ProbableCause}"}
	}
}

```

After running the logstash, the filter seems not working. It doesnt parse anything. Or maybe the problem is my conditional expression? Anyone can help me?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 23, 2017, 8:56pm UTC](https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842/2 "2017-08-23T20:56:53Z")

</div>

The `additionalText` field is an array. If you always want to look at the first element of the array, try replacing `[additionalText]` and `additionalText` with `[additionalText][0]`.

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [August 24, 2017, 6:34am UTC](https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842/3 "2017-08-24T06:34:48Z")

</div>

i need to look into all the elements, how ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 24, 2017, 2:38pm UTC](https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842/4 "2017-08-24T14:38:55Z")

</div>

Then you'll have to use a ruby filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2017, 2:43pm UTC](https://discuss.elastic.co/t/how-to-determine-if-field-contains-a-value/97842/5 "2017-09-21T14:43:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.