# IF ELSE in Logstash INPUT

**URL:** <https://discuss.elastic.co/t/if-else-in-logstash-input/75142>\
**Category:** Logstash\
**Created:** [February 15, 2017, 6:58am UTC](https://discuss.elastic.co/t/if-else-in-logstash-input/75142 "2017-02-15T06:58:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![froto](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@froto](https://discuss.elastic.co/u/froto)\
**Post date:** [February 15, 2017, 6:58am UTC](https://discuss.elastic.co/t/if-else-in-logstash-input/75142/1 "2017-02-15T06:58:43Z")

</div>

Hey there,

at the moment many different systems were sending logs on port 514

Does anyone know if it is possible to declare different type direktly in the input section?

Something like:

input {  
udp {  
port =\> "514"  
if [grok{ patterns\_dir =\> ["/opt/logstash/patterns"]  
match =\> [  
"message", "%{SYSLOG5424PRI}%{NUMBER}: %{CISCOTIMESTAMP}%{CISCOTIMEZONE}]  
}]  
{  
type =\> "cisco"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 15, 2017, 7:02am UTC](https://discuss.elastic.co/t/if-else-in-logstash-input/75142/2 "2017-02-15T07:02:08Z")

</div>

No, but you can change the type in the filter section.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2017, 7:02am UTC](https://discuss.elastic.co/t/if-else-in-logstash-input/75142/3 "2017-03-15T07:02:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.