# If \_grokparsefailure break condition

**URL:** <https://discuss.elastic.co/t/if-grokparsefailure-break-condition/122918>\
**Category:** Logstash\
**Created:** [March 7, 2018, 4:00pm UTC](https://discuss.elastic.co/t/if-grokparsefailure-break-condition/122918 "2018-03-07T16:00:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pfseth](https://avatars.discourse-cdn.com/v4/letter/p/e9bcb4/32.png) [@pfseth](https://discuss.elastic.co/u/pfseth)\
**Post date:** [March 7, 2018, 4:00pm UTC](https://discuss.elastic.co/t/if-grokparsefailure-break-condition/122918/1 "2018-03-07T16:00:14Z")

</div>

is there any way to break if conditions ?

```
filter {
     grok {
           patterns_dir => "/etc/logstash/file/patterns"
           match => { "message" => "%{COMMON_HEADER}" }
          }   
   if "_grokparsefailure" in [tags] {
          ... break and go to output {}
   } else {
          add_tag => ["parsed"]
          ... continue if statement ...
          if {
             if {
              }
          }
          ... go to output {}
}
```

---

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [March 7, 2018, 6:39pm UTC](https://discuss.elastic.co/t/if-grokparsefailure-break-condition/122918/2 "2018-03-07T18:39:49Z")

</div>

```
input {....} 
filter {
grok {
  // .........
}
if [tags] !~ "_grokparsefailure" {
           // do required stuff
}
}
output {....}

```

This is good enough i guess. more over i never came across break statements in logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2018, 6:39pm UTC](https://discuss.elastic.co/t/if-grokparsefailure-break-condition/122918/3 "2018-04-04T18:39:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.