# If conditional not working

**URL:** <https://discuss.elastic.co/t/if-conditional-not-working/205547>\
**Category:** Logstash\
**Created:** [October 28, 2019, 8:49pm UTC](https://discuss.elastic.co/t/if-conditional-not-working/205547 "2019-10-28T20:49:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [October 28, 2019, 8:49pm UTC](https://discuss.elastic.co/t/if-conditional-not-working/205547/1 "2019-10-28T20:49:40Z")

</div>

I have a basic conf file that I'm trying to eventually drop dns traffic but for some reason I can't get the if conditionals to work anymore. Below is all that is in this conf file. I've also tried changing the if statement to if "flow" in [tags] as well but same result. I have other conf files with conditionals that are working just fine so I'm stumped on what's wrong with this one.

```
filter {
  if [tags] == "flow" {
     mutate {
       add_tag => ["dns_traffic"]
     }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 28, 2019, 9:40pm UTC](https://discuss.elastic.co/t/if-conditional-not-working/205547/2 "2019-10-28T21:40:09Z")

</div>

[tags] is an array, so you should use

```
if "flow" in [tags]

```

Can you show an event either using

```
output { stdout { codec => rubydebug } }

```

or copy and paste from the JSON tab in Kibana?

---

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [October 28, 2019, 10:50pm UTC](https://discuss.elastic.co/t/if-conditional-not-working/205547/3 "2019-10-28T22:50:11Z")

</div>

I've tried the if "flow" in [tags] as well and same result but here is the json output.

```
{
  "_index": "flows-2019.44",
  "_type": "doc",
  "_id": "ot-NFG4Bd0HUI2PrhoEY",
  "_version": 1,
  "_score": null,
  "_source": {
    "dst_ip": "4.2.2.2",
    "bytes_out": 61,
    "tags": [
      "bro",
      "flow"
    ],
    "packets_in": 1,
    "event_time_received": "2019-10-28T22:47:29.556Z",
    "packets": 2,
    "conn_state": "SF",
    "transport": "udp",
    "conn_history": "Dd",
    "asn": {
      "asn": 3356,
      "ip": "4.2.2.2",
      "as_org": "Level 3 Communications, Inc."
    },
    "app": "dns",
    "geo": {
      "longitude": -97.822,
      "country_code2": "US",
      "latitude": 37.751,
      "location": {
        "lat": 37.751,
        "lon": -97.822
      },
      "ip": "4.2.2.2",
      "continent_code": "NA",
      "country_name": "United States"
    },
    "@version": "1",
    "src_port": 32768,
    "direction": "outbound",
    "src_ip": "192.168.1.15",
    "bytes_in": 125,
    "packets_out": 1,
    "host": {
      "name": "abc-nsm-0"
    },
    "bytes": 186,
    "dst_port": 53,
    "uuid": "2f49a8df-1a9d-45ec-9935-e52553a400d3",
    "@timestamp": "2019-10-28T22:47:17.149Z",
    "duration": 0.047811
  },
  "fields": {
    "@timestamp": [
      "2019-10-28T22:47:17.149Z"
    ]
  },
  "sort": [
    1572302837149
  ]
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 28, 2019, 11:18pm UTC](https://discuss.elastic.co/t/if-conditional-not-working/205547/4 "2019-10-28T23:18:43Z")

</div>

Do you actually drop traffic that has the dns\_traffic tag? Is it possible that the flow tag is getting added later in the process? Otherwise I cannot think of why this would not work.

---

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [October 28, 2019, 11:40pm UTC](https://discuss.elastic.co/t/if-conditional-not-working/205547/5 "2019-10-28T23:40:22Z")

</div>

Yep, that's exactly what it was. My new conf began with 1010 while the conf that adds the flow tags began with 5000. I changed it to 5010 but it still didn't work however if I change it to letters first ABC5010 then it works. What is the order for processing these files?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 29, 2019, 1:32pm UTC](https://discuss.elastic.co/t/if-conditional-not-working/205547/6 "2019-10-29T13:32:28Z")

</div>

The documentation [states](https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html#command-line-flags) that if path.config is a directory (or wildcard) then "all files in that directory will be concatenated in lexicographical order and then parsed as a single config file". In lexigraphical order in Java numbers come before letters.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2019, 1:32pm UTC](https://discuss.elastic.co/t/if-conditional-not-working/205547/7 "2019-11-26T13:32:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.