# If Else condition based on input log lines in logstash
**URL:** https://discuss.elastic.co/t/if-else-condition-based-on-input-log-lines-in-logstash/277336
**Category:** Logstash
**Created:** [June 29, 2021, 11:19am UTC](https://discuss.elastic.co/t/if-else-condition-based-on-input-log-lines-in-logstash/277336 "2021-06-29T11:19:27Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@sudo-ranjith](https://discuss.elastic.co/u/sudo-ranjith)
#### Post date: [June 29, 2021, 11:19am UTC](https://discuss.elastic.co/t/if-else-condition-based-on-input-log-lines-in-logstash/277336/1 "2021-06-29T11:19:27Z")
Hi There,
I would like to write a logstash config file with an if else condition.
line 1:
"Severity","ThreadID","Date","Time","Application","Message"
GROK for Line 1:
%{DATA:Severity}","%{DATA:ThreadID}","%{DATA:Date}","%{DATA:Time}","%{DATA:Application}","%{GREEDYDATA:Message}
line 2:
"Information","jrpp-0","01/24/13","00:29:50",,"[Workflows] Demo: Begin"
GROK for Line 2:
%{WORD:Severity}","%{DATA:ThreadID}","%{DATA:date}","%{DATA:time}",,"%{GREEDYDATA:message}
I want to ignore the line one logs.
could you please help me to write this logstash.conf file.
filter
{
grok {
```
match => ["message", "%{WORD:Severity}","%{DATA:ThreadID}","%{DATA:date}","%{DATA:time}",,"%{GREEDYDATA:message}"]
```
}
mutate { add\_field =\> { "datetime" =\> "%{date} %{time}" } }
date {
match =\> ["datetime", "YY-MM-dd HH:mm:ss"]
timezone =\> "Etc/UCT"
}
}
thanks in advance.
---
### Author:  [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)
#### Post date: [June 29, 2021, 4:41pm UTC](https://discuss.elastic.co/t/if-else-condition-based-on-input-log-lines-in-logstash/277336/2 "2021-06-29T16:41:01Z")
Hi @sudo-ranjith ,
You can use below code:
In first if condition you can use unique word which is present in all log line1 but not in log line2.
for else if condition you can use unique word which is present in all log line2 but not in log line1.
```auto
if "Application" in [message] {
drop { }
}
else if "Workflows" in [message]{
grok{
match => { "message" => "%{WORD:Severity}","%{DATA:ThreadID}","%{DATA:date}","%{DATA:time}",,"%{GREEDYDATA:message}" }
}
}
```
---
### Author:  [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [June 30, 2021, 8:22am UTC](https://discuss.elastic.co/t/if-else-condition-based-on-input-log-lines-in-logstash/277336/3 "2021-06-30T08:22:52Z")
If you want an option which is not directly related to the content of the lines
```auto
filter {
grok {
match => {"message" => '%{WORD:Severity}","%{DATA:ThreadID}","%{DATA:date}","%{DATA:time}",,"%{GREEDYDATA:message}'}
}
}
output {
if "_grokparsefailure" not in [tags] {
elasticsearch { ... }
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 28, 2021, 8:23am UTC](https://discuss.elastic.co/t/if-else-condition-based-on-input-log-lines-in-logstash/277336/4 "2021-07-28T08:23:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.