# IF conditional not dropping field

**URL:** <https://discuss.elastic.co/t/if-conditional-not-dropping-field/116188>\
**Category:** Logstash\
**Created:** [January 19, 2018, 8:46am UTC](https://discuss.elastic.co/t/if-conditional-not-dropping-field/116188 "2018-01-19T08:46:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [January 19, 2018, 8:46am UTC](https://discuss.elastic.co/t/if-conditional-not-dropping-field/116188/1 "2018-01-19T08:46:01Z")

</div>

Hi,

I'm trying to filter out some data but for some reason the conditional I'm using isn't working. I'm using a similar config for another log and there it's working fine.

I also tried putting the conditional after renaming the fields in case child fields somehow where causing the issue but that isn't working either. What am I doing wrong?

```auto
filter {
  if [type] == "netflow" {

  if [netflow][l4_src_port] == "8888" {
     drop { }
  }

  if [netflow][l4_dst_port] == "8888" {
     drop { }
  }

     mutate {
     add_field => { "location" => "A" }

rename => { "[netflow][ipv4_dst_addr]" => "ipv4_dst_addr" }
rename => { "[netflow][ipv4_src_addr]" => "ipv4_src_addr" }
rename => { "[netflow][l4_src_port]" => "l4_src_port" }
rename => { "[netflow][l4_dst_port]" => "l4_dst_port" }
rename => { "[netflow][out_bytes]" => "out_bytes" }
rename => { "[netflow][in_bytes]" => "in_bytes" }
rename => { "[netflow][in_bytes]" => "in_bytes" }
rename => { "[netflow][protocol]" => "protocol" }

     }

  mutate {
    remove_field => ["@version", "host", "netflow"]
  }
 }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 22, 2018, 9:24pm UTC](https://discuss.elastic.co/t/if-conditional-not-dropping-field/116188/2 "2018-01-22T21:24:56Z")

</div>

As discussed in another thread the problem is probably that you're double-quoting the port numbers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 19, 2018, 9:26pm UTC](https://discuss.elastic.co/t/if-conditional-not-dropping-field/116188/3 "2018-02-19T21:26:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.