# If/Else not working as expected in filter
**URL:** https://discuss.elastic.co/t/if-else-not-working-as-expected-in-filter/128173
**Category:** Logstash
**Created:** [April 16, 2018, 11:15am UTC](https://discuss.elastic.co/t/if-else-not-working-as-expected-in-filter/128173 "2018-04-16T11:15:46Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@va1entin](https://discuss.elastic.co/u/va1entin)
#### Post date: [April 16, 2018, 11:15am UTC](https://discuss.elastic.co/t/if-else-not-working-as-expected-in-filter/128173/1 "2018-04-16T11:15:47Z")
Hey folks,
I am a bit confused regarding use of if else constructs in logstash. I have the following config:
```
filter {
if "apache_access" in [tags] {
grok {
match => { "message" => "%{HTTPD_COMMONLOG}" }
}
}
if "apache_error" in [tags] {
grok {
match => { "message" => "%{HTTPD24_ERRORLOG}" }
}
}
else {
drop { }
}
}
```
What I want it to do is:
- if input has apache\_access in tags, match it
- if input has apache\_error in tags, match it
- else drop it
However the drop applies to anything that comes in. Even if something is matched in i.e. the apache\_access if condition it still jumps to the else condition and drops the input.
This is not how I know If/Else from other programming languages. Is this a bug or the way it's supposed to work?
I know that there are workarounds, like adding a tag to any input in the beginning, removing it only after it's been successfully matched and dropping anything that still has the tag in the end but the construct above seems to be the most straight-forward way of accomplishing what I described.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 16, 2018, 11:27am UTC](https://discuss.elastic.co/t/if-else-not-working-as-expected-in-filter/128173/2 "2018-04-16T11:27:51Z")
Your `else` block is only connected to the second conditional. You need this:
```nohighlight
if ... {
...
} else if ... {
...
} else {
...
}
```
---
### Author:  [@va1entin](https://discuss.elastic.co/u/va1entin)
#### Post date: [April 16, 2018, 11:35am UTC](https://discuss.elastic.co/t/if-else-not-working-as-expected-in-filter/128173/3 "2018-04-16T11:35:19Z")
Thank you very much, @magnusbaeck
That does exactly what I intended. I didn't know that the conditions have to connected like that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 14, 2018, 11:43am UTC](https://discuss.elastic.co/t/if-else-not-working-as-expected-in-filter/128173/4 "2018-05-14T11:43:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.