# If condition after parsing logs in logstash

**URL:** <https://discuss.elastic.co/t/if-condition-after-parsing-logs-in-logstash/226130>\
**Category:** Logstash\
**Created:** [April 1, 2020, 10:11pm UTC](https://discuss.elastic.co/t/if-condition-after-parsing-logs-in-logstash/226130 "2020-04-01T22:11:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sepideh\_Bayati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sepideh_bayati/32/65520_2.png) [@Sepideh\_Bayati](https://discuss.elastic.co/u/Sepideh_Bayati)\
**Post date:** [April 1, 2020, 10:11pm UTC](https://discuss.elastic.co/t/if-condition-after-parsing-logs-in-logstash/226130/1 "2020-04-01T22:11:34Z")

</div>

hello. i have a logstash configuration file and i can parse input logs correctly. my question is: can i have conditions in my parsed data ? is this even possible in logastash config file ?  
for example i want only odd sequence numbers to be stored, or something like this.  
anyone has any idea?  
this is a sample input log:

```auto
<38>2020-04-01T23:30:02 localhost prg00000[1234]: seq: 0000000096, thread: 0000, runid: 1585767601, stamp: 2020-04-01T23:30:02 PADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADD

```

my configuration file:

```auto
input {
  tcp {port => 9000}
  udp {port => 9000}
}
filter {
  dissect {
    mapping => { "message" => "<%{pri}>%{ts} %{host} %{program}[%{pid}]: seq: %{seq}, thread: %{thread}, runid: %{runid}, stamp: %{stamp} %{message}" 
    }
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

```

and this is logstash output after parsing the log:

```auto
{
    "@timestamp" => 2020-04-01T21:07:04.159Z,
       "message" => "<38>2020-04-02T01:37:04 localhost prg00000[1234]: seq: 0000000002, thread: 0000, runid: 1585775222, stamp: 2020-04-02T01:37:04 PADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADD",
          "port" => 47958,
      "@version" => "1",
          "host" => "localhost",
          "tags" => [
        [0] "_grokparsefailure"
    ]
}

```

thank u 😊 🙏

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2020, 11:00pm UTC](https://discuss.elastic.co/t/if-condition-after-parsing-logs-in-logstash/226130/2 "2020-04-01T23:00:36Z")

</div>

> [@Sepideh\_Bayati](#):
>
> for example i want only odd sequence numbers to be stored

You could do that in a ruby filter. I have not tested this but I think it would be

```
ruby {
    code => {
        if event.get("seq").to_i % 2 != 0
            event.cancel
        end
    }
}

```

---

<div class="post-metadata">

**Author:** ![Sepideh\_Bayati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sepideh_bayati/32/65520_2.png) [@Sepideh\_Bayati](https://discuss.elastic.co/u/Sepideh_Bayati)\
**Post date:** [April 2, 2020, 12:24am UTC](https://discuss.elastic.co/t/if-condition-after-parsing-logs-in-logstash/226130/3 "2020-04-02T00:24:26Z")

</div>

> [@Badger](#):
>
> ruby { code =\> { if event.get("seq").to\_i % 2 != 0 event.cancel end } }

thanks a lot @Badger 🥰 i even didn't know there is such a thing like ruby and code in filter. it actually worked like this:

```auto
ruby {
    code => "event.cancel if event.get('seq').to_i % 2 != 0"
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2020, 12:24am UTC](https://discuss.elastic.co/t/if-condition-after-parsing-logs-in-logstash/226130/4 "2020-04-30T00:24:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.