# If condition in Logstash

**URL:** <https://discuss.elastic.co/t/if-condition-in-logstash/134400>\
**Category:** Logstash\
**Created:** [June 4, 2018, 10:08am UTC](https://discuss.elastic.co/t/if-condition-in-logstash/134400 "2018-06-04T10:08:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![paul1243](https://avatars.discourse-cdn.com/v4/letter/p/e99b99/32.png) [@paul1243](https://discuss.elastic.co/u/paul1243)\
**Post date:** [June 4, 2018, 10:08am UTC](https://discuss.elastic.co/t/if-condition-in-logstash/134400/1 "2018-06-04T10:08:43Z")

</div>

Hi,  
I've the logs coming from different sources and I have running thru the ruby code to parse them.  
I need to create an IF condition, so that based on the Job name it has to move to the other ruby loops.  
The Job name comes as something like this in JSON:

```auto
 "data": {
       "JOB_NAME": "ATC/SNX/System1"

```

I wrote a if condition as below:

```auto
filter {
  if [data][JOB_NAME] in "ATC" { 
  ruby {
  code => "
  puts '***'
  "
 }
}

```

But the problem here, if the Job name which doesn't contain 'ATC' is also going thru the ruby code. Could you please help me out. Thanks !

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [June 4, 2018, 12:13pm UTC](https://discuss.elastic.co/t/if-condition-in-logstash/134400/2 "2018-06-04T12:13:33Z")

</div>

I think you want...

```auto
if "ATC" in [data][JOB_NAME]

```

---

<div class="post-metadata">

**Author:** ![iDavico](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/idavico/32/79703_2.png) [@iDavico](https://discuss.elastic.co/u/iDavico)\
**Post date:** [June 4, 2018, 1:24pm UTC](https://discuss.elastic.co/t/if-condition-in-logstash/134400/3 "2018-06-04T13:24:07Z")

</div>

Hi,  
you can do like this:

`if [data][JOB_NAME] in ['ATC']`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 2, 2018, 1:24pm UTC](https://discuss.elastic.co/t/if-condition-in-logstash/134400/4 "2018-07-02T13:24:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.