If elseif else expression in conf - how to use many of them

Hi all,
question: I want to use many if blocks:

is this statement ok or do I need always "else" to end the "if" expression?

	if "Resource" in [Error_Code]{
		mutate {add_tag => "Recource"}
		}
	else if "State" in [Error_Code]{
		mutate {add_tag => "Channel_Error"}
		}
	else if "Key" in [Error_Code]{
		mutate {add_tag => "LogError"}
		}
	else if "Missing" in [Error_Code]{
		mutate {add_tag => "NiceError"}
		}

next

    if "Bla" in [Code]{
		mutate {add_tag => "Bla"}
		}
	else if "Blub" in [Code]{
		mutate {add_tag => "Blub"}
		}
	else if "Bal" in [Error_Code]{
		mutate {add_tag => "Bal"}
		}
	else if "Blo" in [Error_Code]{
		mutate {add_tag => "Blo"}
		}

and so on

What I dont understand how to say if the field is empty:

if "" in [Error_Code]{
    		mutate {add_tag => "allgood"}
    		}

Further:
It is ok to just use "if" by "if" by "if" without having any "else if" nor "else" ?
Means how to say "if" ends here in right way?

Thanks in advance
Regards

Hi @Datakids ,

I find the documentation from Elastic to usually be very informative.

There you can see examples that will show that you do not have to end with an else. There is also an example on an if chain (with multiple if and no else if or else).

Cheers,
AB

Hi,
Cool, I haven't found it yet.
I'm gonna dive into
Cheers

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.