# If condition in the logstash output section

**URL:** <https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456>\
**Category:** Logstash\
**Created:** [June 10, 2020, 8:02am UTC](https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456 "2020-06-10T08:02:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dsv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dsv/32/47173_2.png) [@dsv](https://discuss.elastic.co/u/dsv)\
**Post date:** [June 10, 2020, 8:02am UTC](https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456/1 "2020-06-10T08:02:13Z")

</div>

Hi

Having the latest logstash-7.7.1-1.noarch from the official repo (baseurl=https://artifacts.elastic.co/packages/7.x/yum)

In the output section the  
if "\_grokparsefailure" not in [tags]  
works fine.

But any of the  
if [event][action] =~ /^logged/ or [event][action] =~ /^viewed/  
if [event][action] == "logged"  
if [event][action] in ["logged", "viewed"]  
does not work at all.

What am I missing?  
Need working example.

Thanks

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 10, 2020, 8:11am UTC](https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456/2 "2020-06-10T08:11:56Z")

</div>

It would be helpful to see your data. The field that you use in your condition probably doesn't exist or has a different value than you think.

---

<div class="post-metadata">

**Author:** ![dsv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dsv/32/47173_2.png) [@dsv](https://discuss.elastic.co/u/dsv)\
**Post date:** [June 10, 2020, 8:36am UTC](https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456/3 "2020-06-10T08:36:17Z")

</div>

> [@Jenni](#):
>
> The field that you use in your condition probably doesn't exist or has a different value than you think

I have only the one match clause for such a data:  
`"^Operator %{DATA:user.name} (?<event.action>logged)"`  
and as you can see it's impossible to make mistake.  
Also I see in the kibana the parsed data:  
`event.action logged`

If an any working config exists for a similar task I will go further.

Now after the day of fight i have doubts for a logstash possibilities 🙂

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 10, 2020, 8:46am UTC](https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456/4 "2020-06-10T08:46:26Z")

</div>

So you've got a field `[event.action]`, not `[event][action]`. (The latter would mean that there is a subfield `action` in `event`.)

---

<div class="post-metadata">

**Author:** ![dsv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dsv/32/47173_2.png) [@dsv](https://discuss.elastic.co/u/dsv)\
**Post date:** [June 10, 2020, 12:49pm UTC](https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456/5 "2020-06-10T12:49:31Z")

</div>

It's interesting that  
`if [event.action] =~ /^logged/ or [event.action] =~ /^viewed/`  
works fine, but the same in:  
`if [event.action] in ["logged", "viewed"]`  
doesn't.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 10, 2020, 5:23pm UTC](https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456/6 "2020-06-10T17:23:51Z")

</div>

Those two tests are different.

```
if [event.action] in ["logged", "viewed"]

```

is equivalent to

```
if [event.action] == "logged" or [event.action] == "viewed"
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2020, 5:23pm UTC](https://discuss.elastic.co/t/if-condition-in-the-logstash-output-section/236456/7 "2020-07-08T17:23:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.