# IF condition on the beginning of a log line

**URL:** https://discuss.elastic.co/t/if-condition-on-the-beginning-of-a-log-line/89230
**Category:** Logstash
**Created:** [June 13, 2017, 3:36pm UTC](https://discuss.elastic.co/t/if-condition-on-the-beginning-of-a-log-line/89230 "2017-06-13T15:36:32Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Ksugiu](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@Ksugiu](https://discuss.elastic.co/u/Ksugiu)
#### Post date: [June 13, 2017, 3:36pm UTC](https://discuss.elastic.co/t/if-condition-on-the-beginning-of-a-log-line/89230/1 "2017-06-13T15:36:32Z")

</div>

Hi all :),

Happy to be new to ELK. ( 2 days 😛 )  
I would like to know how to make a condition on the beginnig of a log line.

For exemple :  
This is my log :  
2017-05-31 12:09:50,070 10885 INFO openstack\_auth.views Logging out user "admin".

I have already parsed my log file, and i collect just the log message ("Logging out user "admin".") in LOGMESSAGE variable and i would like to make a condition like this :

`
if [module] == "openstack_auth.forms" AND "LOGMESSAGE BEGIN BY WORD Logging"
{
// My code
}
`

I don't know how to realize the { AND "LOGMESSAGE BEGIN BY WORD _Logging_" } condition...

Can someone tell me how to do ?

Thx for your help 🙂

---

<div class="post-metadata">

### Author: ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)
#### Post date: [June 13, 2017, 7:43pm UTC](https://discuss.elastic.co/t/if-condition-on-the-beginning-of-a-log-line/89230/2 "2017-06-13T19:43:46Z")

</div>

Hi @Ksugiu

If, as you say, you have saved the:-

> Logging out user "admin"

String into a field named "logmessage", then you could do something like:-

```
if [module] == "openstack_auth_forms" and [logmessage] =~ /^Logging.*/ {

   <do stuff>

}

```

---

<div class="post-metadata">

### Author: ![Ksugiu](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@Ksugiu](https://discuss.elastic.co/u/Ksugiu)
#### Post date: [June 14, 2017, 7:04am UTC](https://discuss.elastic.co/t/if-condition-on-the-beginning-of-a-log-line/89230/3 "2017-06-14T07:04:28Z")

</div>

Hi Kryten,

Thx for your reply.  
It's exactlly what i was looking for 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2017, 7:04am UTC](https://discuss.elastic.co/t/if-condition-on-the-beginning-of-a-log-line/89230/4 "2017-07-12T07:04:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.