# How to use if else in logstash output **URL:** \ **Category:** Logstash\ **Created:** [November 26, 2020, 4:00pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793 "2020-11-26T16:00:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![lokeshbabloo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lokeshbabloo/32/81283_2.png) [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Post date:** [November 26, 2020, 4:00pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793/1 "2020-11-26T16:00:59Z")
Hi i need a help in constructing the logstash output i am having two log files like this, one is \<#\> 20200806 17:04:23.261 280018000 EV.INF [MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEBSVR1] Process T1G1\_WEBSVR1 starting in progress... other one is \<#\> 20200806 17:04:23.261 280018000 EV.INF [MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEBSVR1] Process T1G1\_WEBSVR1 starting in progress... and here is my logstash conf input{ ``` stdin { } ``` } filter { grok{ match =\> { "message"=\> "\<#\>\s\*(?\<@log\_date\>%{YEAR}%{MONTHNUM}%{MONTHDAY}\s\*%{TIME})\s\*\s\*%{INT:event\_id}\s\*\s\*%{GREEDYDATA:event\_type}\s\*\s\*[\s\*\s\*%{HOSTNAME:host\_name}.%{USERNAME:Process\_name}\s%{HOSTNAME:thread}\s\*\s\*\s\*\s\*\s\*\s\*%{USERNAME:logger\_name}\s\*\s\*\s\*\s\*\s\*]\s\*\s\*%{GREEDYDATA:log\_message}" } } date { match =\> ["@log\_date", "YYYYMMDD HH:mm:ss.SSS"] target =\> "@log\_date" } mutate { ``` gsub => ["event_type" , "FD.INF" , "Info"] gsub => ["event_type" , "FD.FNE" , "Fine"] gsub => ["event_type" , "TR.FNE" , "Fine"] gsub => ["event_type" , "DE.INF" , "Info"] gsub => ["event_type" , "FD.WRN" , "Warning"] gsub => ["event_type" , "EV.WRN" , "Warning"] gsub => ["event_type" , "DE.WRN" , "Warning"] gsub => ["event_type" , "TR.FNS" , "Finest"] ``` gsub =\> ["event\_type" , "FT.FNR" , "Finer"] gsub =\> ["event\_type" , "EV.INF" , "Info"] gsub =\> ["event\_type" , "FT.FNS" , "Finest"] ``` gsub => ["event_type" , "FT.FNE" , "Finest"] gsub => ["event_type" , "EV.ERR" , "Error"] gsub => ["event_type" , "ST.ERR" , "Error"] gsub => ["event_type" , "DE.ALL" , "Error"] } ``` } output { elasticsearch { ``` hosts => ["127.0.0.1:9200"] index => "mdynamic logs" ``` } } Now here i want to create index different index based on Process name. Can i know how to use if else in the logstash output to elastics search and create index based on process name Thanks and regards Lokesh babloo ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [November 26, 2020, 4:05pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793/2 "2020-11-26T16:05:24Z")
If you just want to use the Process\_name field as the index name then ``` index => "%{Process_name}" ``` ---
**Author:** ![lokeshbabloo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lokeshbabloo/32/81283_2.png) [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Post date:** [November 26, 2020, 4:24pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793/3 "2020-11-26T16:24:53Z")
Hi @Badger , Thank you for your reply but here i will be getting different process\_name like "ATMTH1" as one of the process name and "WEBSVR1" as other process name. if my log contains the Process\_name as "ATMTH1" , i want to create an index named as "ATMTH1" in the elastics search. and if my process\_name contains the process name as "WEBSVR1" , i want to create another index named as "WEBSVR1" as another index. so like if else condition in logstash output towards elasticsearch , any idea Badger? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [November 26, 2020, 5:05pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793/4 "2020-11-26T17:05:22Z")
> [@lokeshbabloo](#): > > if my log contains the Process\_name as "ATMTH1" , i want to create an index named as "ATMTH1" in the elastics search. and if my process\_name contains the process name as "WEBSVR1" , i want to create another index named as "WEBSVR1" as another index That is exactly what the [sprintf](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf) field reference I suggested will do. ---
**Author:** ![lokeshbabloo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lokeshbabloo/32/81283_2.png) [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Post date:** [November 26, 2020, 5:28pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793/5 "2020-11-26T17:28:34Z")
Hi @Badger I tried with index =\> "%{Process\_name}" i am getting this error in output as it is not allowing the uppercase [2020-11-26T22:55:19,623][ERROR][logstash.outputs.elasticsearch][main][6a5880b3351b6e202183bdc3669dd469ae35d8a1fec3a6b90ad56097065a3209] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"WEBSVR1", :routing=\>nil, :\_type=\>"\_doc"}, #LogStash::Event:0x64f3cc21], :response=\>{"index"=\>{"\_index"=\>"WEBSVR1", "\_type"=\>"\_doc", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"invalid\_index\_name\_exception", "reason"=\>"Invalid index name [WEBSVR1], must be lowercase", "index\_uuid"=\>"_na_", "index"=\>"WEBSVR1"}}}} ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [November 26, 2020, 6:23pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793/6 "2020-11-26T18:23:43Z")
> [@lokeshbabloo](#): > > Invalid index name [WEBSVR1], must be lowercase OK, you are going to have to put up with websvr1 as the index name. ``` filter { mutate { lowercase => ["Process_name"] } } ``` ---
**Author:** ![lokeshbabloo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lokeshbabloo/32/81283_2.png) [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Post date:** [December 18, 2020, 1:16pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793/7 "2020-12-18T13:16:00Z")
Hi @Badger yeah thats working. Thank you so much. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 15, 2021, 1:16pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793/8 "2021-01-15T13:16:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.