# If(filter,output) Else(filter,output)

**URL:** <https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097>\
**Category:** Logstash\
**Created:** [March 12, 2021, 2:06pm UTC](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097 "2021-03-12T14:06:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![aannee](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@aannee](https://discuss.elastic.co/u/aannee)\
**Post date:** [March 12, 2021, 2:06pm UTC](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097/1 "2021-03-12T14:06:30Z")

</div>

Hi Elastic Team,

Is this possible in logstash?

```auto
input {
}
if "test" in [mesasge] 
{
      filter {}
      output {}
}
else {
     filter {}
     output {}
}

```

Thank you!

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [March 12, 2021, 2:58pm UTC](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097/2 "2021-03-12T14:58:50Z")

</div>

no but you can do something like this

```
filter {
    if "test" in [message] {
           do stuff
    }
    else {
            do stuff
     }
}
```

---

<div class="post-metadata">

**Author:** ![aannee](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@aannee](https://discuss.elastic.co/u/aannee)\
**Post date:** [March 12, 2021, 3:15pm UTC](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097/3 "2021-03-12T15:15:34Z")

</div>

Thanks for answering! Just needed to ingest same data but different output.

For example. i have this fields.  
name  
age  
bdate

I will ingest name and age only in elasticsearch. But on output file, I will ingest name, age and bdate.

Will this be possible?

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [March 12, 2021, 3:25pm UTC](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097/4 "2021-03-12T15:25:47Z")

</div>

yes possible. but in first post you ask something different. in your latest post you ask something different. you have to use some logic for that

here is answer to first one

```
filter {
    if "test" in [message] {
           do stuff
           mutate => { add_field => { "output1" => "to elk" }
           
    }
    else {
            do stuff
           mutate => { add_field => { "output2" => "to text" }
     }
}

output {
   if [output1] {
            send output to elk
   }
   if [output2] {
           send output to somewhere else
    }
}

```

for second one. basically you are reading name,age,bday but you want only name,age on elk and name,age,bday on text file.

hmm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2021, 3:26pm UTC](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097/5 "2021-04-09T15:26:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.