# How to use Multiple if statements in filter section of logstash configuration file

**URL:** https://discuss.elastic.co/t/how-to-use-multiple-if-statements-in-filter-section-of-logstash-configuration-file/234942
**Category:** Logstash
**Created:** [May 29, 2020, 2:57pm UTC](https://discuss.elastic.co/t/how-to-use-multiple-if-statements-in-filter-section-of-logstash-configuration-file/234942 "2020-05-29T14:57:55Z")
**Posts on this page:** 1
**Showing post:** 11

<div class="post-metadata">

### Author: ![andres-perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andres-perez/32/136461_2.png) [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [June 10, 2020, 10:10am UTC](https://discuss.elastic.co/t/how-to-use-multiple-if-statements-in-filter-section-of-logstash-configuration-file/234942/11 "2020-06-10T10:10:32Z")

</div>

Just to add more information about logstash conditionals: actually the "compare the content of a field with an array" will not test true if there is only 1 element in the array.

```
if [AT_VAL1] in ["SECURED"] # will never test true because it has only 1 element (logstash bug)
if [AT_VAL1] in ["SECURED", "SECURED"] # is equivalent to if [AT_VAL1] == "SECURED"

```

> [@If statement not working with gsub](https://discuss.elastic.co/t/if-statement-not-working-with-gsub/215030/4):
>
> Well, I would say that is the most frequent case: if [field] in ["apples","oranges","pineapples"] { # looks for exact match between the complete field and any of the array elements but, checking carefully the documentation on conditionals: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) It also allows looking for "string in field", equivalent to the regex example you posted. if "apple" in [field] { # will match both "apples" and "pineapples…

I've just discovered the _substring match_ comparison in your last paragraph and it's 🤯 although I don't have a direct use for it.

---

_[View the full topic](https://discuss.elastic.co/t/how-to-use-multiple-if-statements-in-filter-section-of-logstash-configuration-file/234942)._