# How to put condition based on certain string in \[message\]?

**URL:** <https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169>\
**Category:** Logstash\
**Created:** [April 7, 2018, 3:48pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169 "2018-04-07T15:48:48Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [April 7, 2018, 3:48pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169/1 "2018-04-07T15:48:48Z")

</div>

Hi,

I am trying to apply grok only if message has certain string. For example my message has `source_type=\"APP/PROC/WEB\"` and my config looks like,

```
if "source_type=\"APP" in [message]{
do something
}

```

Condition is not working at all. Please help me to use condition to check above mentioned string in [message]

Thanks

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 7, 2018, 7:44pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169/2 "2018-04-07T19:44:27Z")

</div>

> [@amruth](#):
>
> if "source\_type="APP" in [message]{

The syntax is incorrect. Usually this one is used to check if a string is in an array field like `if "_grokparsefailure" in [tags]`. In your case you can use regex as in [Logstash if statement with regex example](https://discuss.elastic.co/t/logstash-if-statement-with-regex-example/75706)

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [April 7, 2018, 7:53pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169/3 "2018-04-07T19:53:44Z")

</div>

Hi,

I didn't clearly understand what you mean. [This](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) explains what I am using is correct.

```
if "hello" in [greeting] {
    mutate { add_tag => "string in field" }
  }

```

I am using something like above.

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 7, 2018, 8:28pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169/4 "2018-04-07T20:28:03Z")

</div>

I see, I guess because your search string contains double quotes. Have you given regex a try? It should work properly.

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 7, 2018, 10:09pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169/5 "2018-04-07T22:09:01Z")

</div>

[https://www.elastic.co/guide/en/logstash/master/config-examples.html#using-conditionals](https://www.elastic.co/guide/en/logstash/master/config-examples.html#using-conditionals)

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [April 8, 2018, 1:16am UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169/6 "2018-04-08T01:16:32Z")

</div>

> [@anhlqn](#):
>
> Have you given regex a try? It should work properly.

What do you mean by regex here? I am not matching for a word or an integer but a particular string.

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 10, 2018, 11:08pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169/7 "2018-04-10T23:08:04Z")

</div>

I mean your search string `source_type=\"APP/PROC/WEB\"` may have special characters that don't work in the normal `in` syntax.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2018, 11:08pm UTC](https://discuss.elastic.co/t/how-to-put-condition-based-on-certain-string-in-message/127169/8 "2018-05-08T23:08:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.