# How to hold a state in Logstash?

**URL:** <https://discuss.elastic.co/t/how-to-hold-a-state-in-logstash/120887>\
**Category:** Logstash\
**Created:** [February 21, 2018, 4:01pm UTC](https://discuss.elastic.co/t/how-to-hold-a-state-in-logstash/120887 "2018-02-21T16:01:50Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![daved](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@daved](https://discuss.elastic.co/u/daved)\
**Post date:** [February 21, 2018, 4:01pm UTC](https://discuss.elastic.co/t/how-to-hold-a-state-in-logstash/120887/1 "2018-02-21T16:01:50Z")

</div>

Hi,

I'm trying to apply a state (with a field in ES) to subsequent log lines after seeing `[message] =~ "foo"` but have not had luck using class variables with the ruby filter (`@@classVariable`) as described in [Keeping global variables in LS?!](https://discuss.elastic.co/t/keeping-global-variables-in-ls/39908) with logstash 6.0.1.

I find that the class variable does not hold the correct value when exploring the data on discover in Kibana. Specifically, I want the state to change when I see `[message] =~ "bar"` and then hold that value until `[message] =~ "foo"` is seen, however I notice that the state will change value when it should not have. I'm using a different named capture from grok (that I also store in ES) to set the state when it is present, and when the state changes that named capture isn't even present, so something else is changing this class variable.

It's been two years since that post, and this doesn't seem like an unreasonable thing for someone to do, so I'm hoping there's another method now that I haven't found?

Thanks,  
Dave

---

_[View the full topic](https://discuss.elastic.co/t/how-to-hold-a-state-in-logstash/120887)._