# If condition not working in logstash output **URL:** \ **Category:** Logstash\ **Created:** [August 23, 2018, 7:32am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671 "2018-08-23T07:32:58Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ashok9177](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Post date:** [August 23, 2018, 7:32am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/1 "2018-08-23T07:32:59Z")
Here is my logstash config file, the issue is logstash not forwarding logs to all outputs, only 2 outputs are working ```auto output { if [fields][component] == "cat" { file { path => "/data/cat/cat.%{+yyyy.MM.dd}" } } else if [fields][component] == "idt256" { file { path => "/data/idt256/idt256.%{+yyyy.MM.dd}" } } else if [fields][component] == "idt512" { file { path => "/data/idt512/idt512.log.%{+yyyy.MM.dd}" } } else if [fields][component] == "ida" { file { path => "/data/ida/ida.log.%{+yyyy.MM.dd}" } } elasticsearch { hosts => ["https://node1:9200"] user => 'elastic' cacert => '/opt/elasticsearch/ca/ca.crt' password => 'password' manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" } } ``` the first and last (cat&ida) output is working , remaining not can anyone please suggest what's wrong in if condition? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2018, 9:52am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/2 "2018-08-23T09:52:31Z")
Please look in Elasticsearch for an example document that didn't reach its intended file. Show it to us. You can e.g. copy/paste from Kibana's JSON tab so you get the raw event. ---
**Author:** ![ashok9177](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Post date:** [August 23, 2018, 10:06am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/3 "2018-08-23T10:06:12Z")
@magnusbaeck Thanks for response, if you observe in my logstash output there five different outputs, 3 are working but 2 are not working? that's my problem, I am getting all the logs into kibana . ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2018, 10:47am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/4 "2018-08-23T10:47:02Z")
Yes, I understand what the problem is. Please just answer my question. ---
**Author:** ![ashok9177](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Post date:** [August 23, 2018, 11:07am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/5 "2018-08-23T11:07:03Z")
@magnusbaeck { "\_index": "filebeat-2018.08.23", "\_type": "doc", "\_id": "4GdyZmUBcoO0sqzqu8Ao", "\_version": 1, "\_score": null, "\_source": { "@timestamp": "2018-08-23T11:01:53.613Z", "message": "2018-08-23T11:01:45.475Z\tINFO\t[monitoring]\tlog/log.go:124\tNon-zero metrics in the last 30s\t{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":50070,"time":50073},"total":{"ticks":239070,"time":239081,"value":239070},"user":{"ticks":189000,"time":189008}},"info":{"ephemeral\_id":"9f45d31b-1b85-49b3-982b-5075b4163934","uptime":{"ms":463500053}},"memstats":{"gc\_next":8590496,"memory\_alloc":6183448,"memory\_total":65102754368}},"filebeat":{"events":{"added":1,"done":1},"harvester":{"open\_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":1,"batches":1,"total":1},"read":{"bytes":35},"write":{"bytes":764}},"pipeline":{"clients":1,"events":{"active":0,"published":1,"total":1},"queue":{"acked":1}}},"registrar":{"states":{"current":10,"update":1},"writes":1},"system":{"load":{"1":0.28,"15":0.08,"5":0.2,"norm":{"1":0.0175,"15":0.005,"5":0.0125}}}}}}", "fields": { "component": "idt.256" } }, "fields": { "@timestamp": [ "2018-08-23T11:01:53.613Z" ] }, "highlight": { "fields.component": [ "@kibana-highlighted-field@idt@/kibana-highlighted-field@.@kibana-highlighted-field@256@/kibana-highlighted-field@" ] }, "sort": [ 1535022113613 ] } here is my json output from kibana, can you please correct me on if condition ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2018, 2:14pm UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/6 "2018-08-23T14:14:47Z")
This document's `[fields][component]` field contains `idt.256` but your conditional says `idt256`. ---
**Author:** ![ashok9177](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Post date:** [August 24, 2018, 6:30am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/7 "2018-08-24T06:30:03Z")
@magnusbaeck thanks for guiding me, it worked for me, one question, I want to configure multiple outputs in logstash, logstash should export all logs to elasticsearch and as well as text files also. how can i implement that ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 24, 2018, 6:32am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/8 "2018-08-24T06:32:55Z")
Just list multiple outputs in your `output { ... }` block. One elasticsearch output and one file output, for example. ---
**Author:** ![ashok9177](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Post date:** [August 24, 2018, 6:37am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/9 "2018-08-24T06:37:56Z")
okay got it. Thank you Have a good day. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 21, 2018, 6:38am UTC](https://discuss.elastic.co/t/if-condition-not-working-in-logstash-output/145671/10 "2018-09-21T06:38:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.