# If conditional " in " doesn't work, but " == " does? I need the "in" conditional to work!
**URL:** https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441
**Category:** Logstash
**Created:** [March 24, 2018, 2:44pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441 "2018-03-24T14:44:43Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@JimP](https://discuss.elastic.co/u/JimP)
#### Post date: [March 24, 2018, 2:44pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/1 "2018-03-24T14:44:43Z")
In my logstash .conf, filter section when I use "==" it works, but when I replace with "in" it doesn't. Further down in the script, I do use "in" with multiple values, and none of them work either. Am I missing something?
"==" succeeds
```
filter {
if [app_id.keyword] == ["LoggingService"] {
grok {
```
"in" fails
```
filter {
if [app_id.keyword] in ["LoggingService"] {
grok {
```
RHEL 7, Logstash 6.2.0 then updated to 6.2.3, still doesn't work.
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [March 25, 2018, 2:47am UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/2 "2018-03-25T02:47:07Z")
IIRC, The right-hand-side of an `in` clause gets parsed as a field reference, not as a literal array as you're attempting.
Unfortunately, the grammar is ambiguous, and field references have a higher precedence than literal arrays, so there's not much we can do to fix it without breaking the situation when people do intentionally have a field reference there.
While it is certainly more verbose, using equality along-side `or` clauses is going to be your best bet:
```auto
if [field] == "a" or [field] == "b" {
# ...
}
```
---
### Author:  [@JimP](https://discuss.elastic.co/u/JimP)
#### Post date: [March 26, 2018, 11:31am UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/3 "2018-03-26T11:31:30Z")
Thank you for explaining.
---
### Author:  [@JimP](https://discuss.elastic.co/u/JimP)
#### Post date: [March 26, 2018, 12:14pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/4 "2018-03-26T12:14:27Z")
I made the change, but it only worked with the [] around my string, ["LoggingService"].
```
[app_id.keyword] == ["LoggingService"]
```
---
### Author:  [@JimP](https://discuss.elastic.co/u/JimP)
#### Post date: [March 26, 2018, 7:54pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/5 "2018-03-26T19:54:49Z")
I just retried and this works:
```
if [app_id.keyword] == ["LoggingService"] {
```
This doesn't
```
if [app_id.keyword] == "LoggingService" {
```
Here's the whole file:
```
input {
beats {
port => 5044
# congestion_threshold => "999999999"
}
}
filter {
if [app_id.keyword] == ["LoggingService"] {
grok {
patterns_dir => ["/etc/logstash/conf.d/patterns"]
match => ["message", "%{GREEDYDATA:Message}Timestamp : %{TIMESTAMP_ISO8601:logtime}"]
}
date {
match => ["logtime", "ISO8601", "yyyy-MM-dd HH:mm:ss.SSSS", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSS'Z'"]
target => "@timestamp"
}
mutate {
gsub => [
"message", "--------------- Event Log Start Here ---------------\n","",
"message", "\n--------------- Event Log End Here ---------------", ""
]
remove_field => ["logtime", "Message"]
}
}
}
output {
# if "_grokparsefailure" in [tags] {
# # write events that didn't match to a file
# file { "path" => "/opt/logstash/grok_failures.txt" }
# } else {
elasticsearch {
hosts => "10.54.52.31:9200"
user => "logstash_writer"
password => "lastmile"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
#document_type => "%{[@metadata][type]}"
}
# }
}
```
---
### Author:  [@JimP](https://discuss.elastic.co/u/JimP)
#### Post date: [March 26, 2018, 8:03pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/6 "2018-03-26T20:03:25Z")
Sheesh, OK this works. Seems like I didn't need the ".keyword"!
```
if [app_id] == "LoggingService" {
```
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [March 26, 2018, 9:35pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/7 "2018-03-26T21:35:46Z")
I believe you have to use `[app_id][keyword]` instead of `[app_id.keyword]` in Logstash config to refers to a child field.
---
### Author:  [@JimP](https://discuss.elastic.co/u/JimP)
#### Post date: [April 10, 2018, 8:56pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/8 "2018-04-10T20:56:20Z")
[app\_id] is not a child field in my setup. Thanks.
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [April 10, 2018, 11:02pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/9 "2018-04-10T23:02:04Z")
> [@JimP](#):
>
> Sheesh, OK this works. Seems like I didn't need the ".keyword"!
>
> if [app\_id] == "LoggingService" {
It seems to me that you confused the `.keyword` multi-field in ES mappings with the actual field name being processed in Logstash?
---
### Author:  [@JimP](https://discuss.elastic.co/u/JimP)
#### Post date: [April 11, 2018, 1:57pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/10 "2018-04-11T13:57:22Z")
Correct.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 9, 2018, 1:57pm UTC](https://discuss.elastic.co/t/if-conditional-in-doesnt-work-but-does-i-need-the-in-conditional-to-work/125441/11 "2018-05-09T13:57:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.