# If condition, with csv filter not working **URL:** \ **Category:** Logstash\ **Created:** [September 4, 2017, 11:06am UTC](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283 "2017-09-04T11:06:35Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vipinkumar](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@vipinkumar](https://discuss.elastic.co/u/vipinkumar)\ **Post date:** [September 4, 2017, 11:06am UTC](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283/1 "2017-09-04T11:06:35Z")
i am trying to apply 'if' condition on the bases of field which i have defined in filebeat.yml file, and inside 'if' condition i have placed a csv filter which is supposed to filter the data and those data should be displayed in Kibana as a independent fields. But now all the data is displayed as a message. Below is my Filebeat.yml conf ``` filebeat.prospectors: - input_type: log paths: - /var/opt/statistics/ServerIf.stat fields: document: ServerIf - input_type: log paths: - /var/opt/statistics/ClientIf.stat fields: document: ClientIf output.logstash: hosts: ["localhost:5043"] ``` Below is my logstash pipeline config ``` input { beats { port => "5043" } } filter { if[document] == "ServerIf" { csv { autodetect_column_names => true separator => "," convert => { "DATE/TIME" => "date_time" "EnquiryIn" => "integer" "EnquiryOut" => "integer" "BalanceUsed" => "integer" "BalanceLeft" => "integer" } } } else if[document] == "ClientIf" { csv { autodetect_column_names => true separator => "," } } } output { elasticsearch { hosts => ["localhost:9200"] } } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 4, 2017, 11:24am UTC](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283/2 "2017-09-04T11:24:21Z")
Please show an example event that Logstash has processed (but incorrectly so). Use a `stdout { codec => rubydebug }` output. ---
**Author:** ![vipinkumar](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@vipinkumar](https://discuss.elastic.co/u/vipinkumar)\ **Post date:** [September 5, 2017, 4:58am UTC](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283/3 "2017-09-05T04:58:32Z")
Hi magnusbaeck I change the output to stdout { codec =\> rebydebug } , after that i started to receive error in logstash. `[2017-09-05T06:54:21,108][FATAL][logstash.runner] An unexpected error occurred! {:error=>#, :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/awesome\_print-1.8.0/lib/awesome\_print/inspector.rb:163:in `merge_custom_defaults!'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/awesome_print-1.8.0/lib/awesome_print/inspector.rb:50:in`initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/awesome\_print-1.8.0/lib/awesome\_print/core\_ext/kernel.rb:9:in `ai'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-rubydebug-3.0.3/lib/logstash/codecs/rubydebug.rb:39:in`encode\_default'", "org/jruby/RubyMethod.java:120:in `call'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-rubydebug-3.0.3/lib/logstash/codecs/rubydebug.rb:35:in`encode'", "/usr/share/logstash/logstash-core/lib/logstash/codecs/base.rb:50:in `multi_encode'", "org/jruby/RubyArray.java:1613:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/codecs/base.rb:50:in `multi_encode'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:90:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator\_strategies/single.rb:15:in `multi_receive'", "org/jruby/ext/thread/Mutex.java:149:in`synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator\_strategies/single.rb:14:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:47:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:420:in `output_batch'", "org/jruby/RubyHash.java:1342:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:419:in `output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:365:in`worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:330:in `start_workers'"]}` Thanks, Vipin Kumar ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 5, 2017, 5:44am UTC](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283/4 "2017-09-05T05:44:47Z")
Hmm. Appears to be a bug. Unless you have particular dependencies you can try downgrading Logstash. > ---
**Author:** ![vipinkumar](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@vipinkumar](https://discuss.elastic.co/u/vipinkumar)\ **Post date:** [September 8, 2017, 10:11am UTC](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283/5 "2017-09-08T10:11:02Z")
I have find the issue , the "if" condition which i was using was not used in proper way. The correct way is below ``` input { beats { port => "5043" } } filter { if[fields][document] == "ServerIf" { csv { autodetect_column_names => true separator => "," convert => { "DATE/TIME" => "date_time" "EnquiryIn" => "integer" "EnquiryOut" => "integer" "BalanceUsed" => "integer" "BalanceLeft" => "integer" } } } else if[fields][document] == "ClientIf" { csv { autodetect_column_names => true separator => "," } } } output { elasticsearch { hosts => ["localhost:9200"] } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 6, 2017, 10:11am UTC](https://discuss.elastic.co/t/if-condition-with-csv-filter-not-working/99283/6 "2017-10-06T10:11:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.