# If expression confusion
**URL:** https://discuss.elastic.co/t/if-expression-confusion/195409
**Category:** Logstash
**Created:** [August 16, 2019, 12:11am UTC](https://discuss.elastic.co/t/if-expression-confusion/195409 "2019-08-16T00:11:13Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@nnet](https://discuss.elastic.co/u/nnet)
#### Post date: [August 16, 2019, 12:11am UTC](https://discuss.elastic.co/t/if-expression-confusion/195409/1 "2019-08-16T00:11:13Z")
Hi, in trying to create an conditional `if` expression, I started with:
```
if [tags] == "blah" or [tags] == "blah2" or [tags] == "blah3" { blah }
```
but event data wasn't being "caught" by this expression.
I then changed the expression to:
```
if "blah" in [tags] or "blah2" in [tags] or "blah3" in [tags] { blah }
```
I have filters where I use expressions having `if [tags] == "blah" { blah }` that work.
Why does the first expression fail but the second one works?
Thanks
---
### Author:  [@nnet](https://discuss.elastic.co/u/nnet)
#### Post date: [August 17, 2019, 2:09pm UTC](https://discuss.elastic.co/t/if-expression-confusion/195409/2 "2019-08-17T14:09:41Z")
Can anyone provide some insight, thanks!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 17, 2019, 2:23pm UTC](https://discuss.elastic.co/t/if-expression-confusion/195409/3 "2019-08-17T14:23:37Z")
tags is an array that may contain more than one member, so testing for array membership using "in" is the right way to do this.
```
if [tags][0] == "blah" { ... }
```
will also work.
---
### Author:  [@nnet](https://discuss.elastic.co/u/nnet)
#### Post date: [August 17, 2019, 4:27pm UTC](https://discuss.elastic.co/t/if-expression-confusion/195409/4 "2019-08-17T16:27:59Z")
@Badger thanks for the explanation...your example `[tags][0] == "blah" { ... }` would test for the first element in the array if I understand correctly.
Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2019, 4:28pm UTC](https://discuss.elastic.co/t/if-expression-confusion/195409/5 "2019-09-14T16:28:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.