# If in filter drops event

**URL:** <https://discuss.elastic.co/t/if-in-filter-drops-event/212759>\
**Category:** Logstash\
**Created:** [December 22, 2019, 2:27am UTC](https://discuss.elastic.co/t/if-in-filter-drops-event/212759 "2019-12-22T02:27:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![indikaM](https://avatars.discourse-cdn.com/v4/letter/i/3d9bf3/32.png) [@indikaM](https://discuss.elastic.co/u/indikaM)\
**Post date:** [December 22, 2019, 2:27am UTC](https://discuss.elastic.co/t/if-in-filter-drops-event/212759/1 "2019-12-22T02:27:34Z")

</div>

Hey all,

I am using CSV filter plugin and I want to check a field value and if exists I want to add a new field. However when I add an "if' condition , the relevant event is missing in the output

log event

\<14\>Dec 20 15:56:37 10.1.2.225 1,2019/12/20 15:56:37,001801033544,TRAFFIC,start,2049,2019/12/20 15:56:37,xxx.xxx.xxxx.xxx,,TFAPP02 access for Users,,,web-browsing,vsys1,10.0.0  
.0-10.255.255.255,0,3,1,n/a,0,0,0,0,,from-policy,,,0,,0,,N/A,0,0,0,0

conf file

input {  
file {  
path =\> "/usr/src/plugin/paloalto/log.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter {  
csv {  
skip\_empty\_columns =\> true  
columns =\> ["number","datetime","id","NETTYPE","action","col6", "col7" ,"src\_ip","dst\_ip"]  
}  
mutate { add\_field =\> {"pluginid" =\> "90515" }}  
mutate { add\_field =\> {"datetype" =\> "1"}}  
if [action] == "start" {  
mutate { add\_field =\> { "plugin\_sid" =\> "456" }}  
}  
}  
output {  
stdout { codec =\> rubydebug }  
}

I am getting all outputs except [action] = "start" events, if I remove the "if" condition I get all the events.

I get the following at the end of the output

{  
"message" =\> "",  
"path" =\> "/usr/src/plugin/paloalto/log.log",  
"host" =\> "sm\_siem\_db\_mw1",  
"@timestamp" =\> 2019-12-22T02:24:54.268Z,  
"pluginid" =\> "90515",  
"@version" =\> "1",  
"tags" =\> [  
[0] "\_csvparsefailure"  
],  
"datetype" =\> "1"  
}

---

<div class="post-metadata">

**Author:** ![indikaM](https://avatars.discourse-cdn.com/v4/letter/i/3d9bf3/32.png) [@indikaM](https://discuss.elastic.co/u/indikaM)\
**Post date:** [December 22, 2019, 3:38am UTC](https://discuss.elastic.co/t/if-in-filter-drops-event/212759/2 "2019-12-22T03:38:40Z")

</div>

Hey All,  
I found what the problem was with the events being dropped. Actually it was not getting dropped, but the output had put the "start" events to the very begging of the out put, so I was not able to see them.

However I still do not know what I get a "\_csvparsefailure"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 19, 2020, 3:38am UTC](https://discuss.elastic.co/t/if-in-filter-drops-event/212759/3 "2020-01-19T03:38:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.