# How to use 'AND' in Logstash? **URL:** \ **Category:** Logstash\ **Created:** [May 21, 2018, 8:13pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695 "2018-05-21T20:13:03Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [May 21, 2018, 8:13pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/1 "2018-05-21T20:13:03Z")
Hi, Can someone please say if it's correct to use the following, `if [message] =~ /department=technology&space=dev/{ ... }` Basically I am looking in [message] for the fields department and space. I am using operator &, please let me know if it's correct to use '&' as AND. Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 21, 2018, 9:22pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/2 "2018-05-21T21:22:15Z")
`&` has no special meaning in regular expressions. If you give an example of the kind of string you want to match we'll be in a better position to help. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [May 22, 2018, 1:56pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/3 "2018-05-22T13:56:10Z")
Hi Magnus, Basically I am looking for two strings, ``` 1)department=technology 2)space=dev ``` If [message] contains above two strings then do something. This is what I am searching for. Can you please help me with it? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 22, 2018, 7:48pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/4 "2018-05-22T19:48:54Z")
If you don't care about the ordering of them you can do ``` if "department=technology" in [message] and "space=dev" in [message] { ... } ``` but that won't distinguish between "space=dev" and "nospace=development" which might not be good enough for your needs. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [May 23, 2018, 1:42pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/5 "2018-05-23T13:42:46Z")
Can I use something like, `if [message] =~ /department=technology/ and [message] =~ /space=dev/{ ... }` Would this work as expected? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 23, 2018, 1:50pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/6 "2018-05-23T13:50:26Z")
Yes, it's equivalent to my proposal. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [May 23, 2018, 2:27pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/7 "2018-05-23T14:27:53Z")
Okay, but how exactly we can deal with this? Isn't there any way where we can strictly define our need? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 23, 2018, 6:56pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/8 "2018-05-23T18:56:49Z")
As I said, if you give an example of the kind of string you want to match we'll be in a better position to help. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [May 24, 2018, 5:26pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/9 "2018-05-24T17:26:26Z")
Didn't clearly understand it. Are you asking for the strings, if so these are the two strings I am looking for in an event, ``` department=technology space=dev ``` If you are asking about how an event looks like, `level=info app_id=467-mng-5478 department=technology app_name=test-qa org_id=65hjc-9hd-4dg0-bsgc-12yjk4r13 space=dev org_name=QA origin=server` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 24, 2018, 5:37pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/10 "2018-05-24T17:37:09Z")
There, finally. Use a kv filter to parse the string into fields, then use a conditional like this: ``` if [department] == "technology" and [space] == "dev" { ... } ``` ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [May 24, 2018, 5:40pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/11 "2018-05-24T17:40:46Z")
what if I am not including those keys from kv? ---
**Author:** ![sm00thindian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sm00thindian/32/27376_2.png) [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)\ **Post date:** [May 24, 2018, 7:12pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/12 "2018-05-24T19:12:31Z")
Rename the fields after the filter ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 21, 2018, 7:12pm UTC](https://discuss.elastic.co/t/how-to-use-and-in-logstash/132695/13 "2018-06-21T19:12:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.