# How to write if condition inside of the logstash grok pattern?
**URL:** https://discuss.elastic.co/t/how-to-write-if-condition-inside-of-the-logstash-grok-pattern/133330
**Category:** Logstash
**Created:** [May 25, 2018, 2:14pm UTC](https://discuss.elastic.co/t/how-to-write-if-condition-inside-of-the-logstash-grok-pattern/133330 "2018-05-25T14:14:37Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Yusuf\_Karatoprak](https://discuss.elastic.co/u/Yusuf_Karatoprak)
#### Post date: [May 25, 2018, 2:14pm UTC](https://discuss.elastic.co/t/how-to-write-if-condition-inside-of-the-logstash-grok-pattern/133330/1 "2018-05-25T14:14:37Z")
My question is related to logstash grok pattern. I created below pattern that's working fine but the big problem is not string values. Sometimes; "Y" and "age" can be null so my grok pattern not create any log in elasticseach. It is not working properly. I need to tell my grok pattern 🙂
```
if(age is null || age i empty){
```
updatefield["age",0]
}
but I don't know how to make it. by the way; I checked many solutions by googling but it is directly related to my problem.
```
input {
```
file {
path =\> ["C:/log/\*.log"]
start\_position =\> "beginning"
discover\_interval =\> 10
stat\_interval =\> 10
sincedb\_write\_interval =\> 10
close\_older =\> 10
codec =\> multiline {
pattern =\> "^%{TIMESTAMP\_ISO8601}|"
negate =\> true
what =\> "previous"
}
}
}
filter {
grok {
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:formattedDate}.\* X: %{DATA:X} Y: %{NUMBER:Y} Z: %{DATA:Z} age: %{NUMBER:age:int} "}
}
date {
timezone =\> "Europe/Istanbul"
match =\> ["TimeStamp", "ISO8601"]
}
json{
source =\> "request"
target =\> "parsedJson"
```
}
mutate {
remove_field => ["path","message","tags","@version"]
}
```
}
output {
```
stdout {
codec => rubydebug
}
```
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)" ]
index =\> "logstash-%{+YYYY.MM}"
```
}
```
}
---
### Author:  [@arkady\_renko](https://discuss.elastic.co/u/arkady_renko)
#### Post date: [May 25, 2018, 2:23pm UTC](https://discuss.elastic.co/t/how-to-write-if-condition-inside-of-the-logstash-grok-pattern/133330/2 "2018-05-25T14:23:20Z")
My suggestion has two steps.
1- define age and Y as optional field in grok filter.
(%{NUMBER:age})?
2-check existence of age field.if it missing add with mutate.
if ![age] {
mutate { add\_field =\> { "age" =\> 0} }
}
---
### Author:  [@Yusuf\_Karatoprak](https://discuss.elastic.co/u/Yusuf_Karatoprak)
#### Post date: [May 25, 2018, 3:19pm UTC](https://discuss.elastic.co/t/how-to-write-if-condition-inside-of-the-logstash-grok-pattern/133330/3 "2018-05-25T15:19:45Z")
When I add grok filter, "age" =\> 0 is adding inside json result. But the other fields disappear. I guess that I have to add if clause before grok pattern. because when I send bull to "age" it can not translate into integer. Thanks mehmet.
---
### Author:  [@arkady\_renko](https://discuss.elastic.co/u/arkady_renko)
#### Post date: [May 25, 2018, 4:37pm UTC](https://discuss.elastic.co/t/how-to-write-if-condition-inside-of-the-logstash-grok-pattern/133330/4 "2018-05-25T16:37:22Z")
I think if statement should be after grok filter. Afaik if you define age as optional and if it is null, grok filter doesnt add age field to the event. So you can check if it is exists or not.
Sample log lines would w/and w/o age would be helpful to investigate.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 22, 2018, 4:37pm UTC](https://discuss.elastic.co/t/how-to-write-if-condition-inside-of-the-logstash-grok-pattern/133330/5 "2018-06-22T16:37:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.