# If else condition for pipeline filter. How to normalise data before making into Common schema?

**URL:** <https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768>\
**Category:** Logstash\
**Created:** [August 28, 2020, 1:19pm UTC](https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768 "2020-08-28T13:19:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [August 28, 2020, 1:19pm UTC](https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768/1 "2020-08-28T13:19:32Z")

</div>

We got certain sources coming from syslog servers (different type of data) in a single pipeline. I wanted to split the single pipeline into multiple datasets before applying the common schema  
For instance, the syslog dataset currently comes up with auditd, /var/log/secure, /var/log/messages etc and I've written grok patterns for each of them in a patterns directory

In the logstash pipeline layer, i'm trying to do something like below, but not working

```
filter {
  if [log.file.path] == "/var/log/*audit*" {
    mutate {
      add_field = {
            "datatype": "nix_audit"
       }
     }
   }
  if [log.file.path] == "/var/log/maillog" {
    mutate {
      add_field = {
            "datatype": "nix_mail"
       }
     }
   }
}

```

But this is NOT adding datatype field. I was planning then to apply the pattern for "nix\_audit" datatype, so all the fields populate as per the pattern and is maintained only once

Update1:  
I even tried as per [link] but still not working with nested field structure. ([https://www.elastic.co/guide/en/logstash/current/field-references-deepdive.html](https://www.elastic.co/guide/en/logstash/current/field-references-deepdive.html))

```auto
      if [log][file][path] == "/var/log/maillog" {
        mutate {
          add_field = {
                "datatype": "nix_mail"
           }
          }
       }

```

---

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [August 29, 2020, 1:12pm UTC](https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768/2 "2020-08-29T13:12:45Z")

</div>

Marking as closed as the second option worked (i.e. ` [log][file][path] =~ "/var/log/maillog*"` )

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2020, 1:12pm UTC](https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768/3 "2020-09-26T13:12:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.