# If statement in winlogbeat configuration

**URL:** https://discuss.elastic.co/t/if-statement-in-winlogbeat-configuration/340393
**Category:** Beats
**Tags:** winlogbeat
**Created:** [August 8, 2023, 6:13pm UTC](https://discuss.elastic.co/t/if-statement-in-winlogbeat-configuration/340393 "2023-08-08T18:13:03Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![msylvestre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/msylvestre/32/124447_2.png) [@msylvestre](https://discuss.elastic.co/u/msylvestre)
#### Post date: [August 8, 2023, 6:13pm UTC](https://discuss.elastic.co/t/if-statement-in-winlogbeat-configuration/340393/1 "2023-08-08T18:13:03Z")

</div>

Hello,

I'm trying to add an **IF** statement in my winlogbeat configuration, but I can't figure out how. Basically I have a field named token that I need to changed based on the agent\_name. What am I missing?

```auto
###################### Winlogbeat Configuration ##########################

winlogbeat.event_logs:
  - name: Application
    ignore_older: 720h
  - name: Security
    ignore_older: 720h
  - name: System
    ignore_older: 720h

fields:
  logzio_codec: json
  token: AAAAAAAAAAAAAAAAAAAAAAA
  type: wineventlog
fields_under_root: true

# processors:
# - if:
# winlogbeat.agent:
# name: "HOSTNAME"
# then:
# - replace:
# fields:
# token : BBBBBBBBBBBBBBBBB
#

#----------------------------- Logstash output -----------------------------
output.logstash:
  hosts: [host:port]
  ssl:
    certificate_authorities: [path]

```

Thank you,

Mathieu

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 8, 2023, 6:37pm UTC](https://discuss.elastic.co/t/if-statement-in-winlogbeat-configuration/340393/2 "2023-08-08T18:37:57Z")

</div>

These two examples are equivalent.

```yaml
processors:
  - if:
      equals:
        agent.name: "HOSTNAME"
    then:
      - add_fields:
          target: ''
          fields:
            token: BBBBBBBBBBBBBBBBB

```

```yaml
processors:
  - add_fields:
      when:
        equals:
          agent.name: "HOSTNAME"
      target: ''
      fields:
        token: BBBBBBBBBBBBBBBBB

```

---

<div class="post-metadata">

### Author: ![msylvestre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/msylvestre/32/124447_2.png) [@msylvestre](https://discuss.elastic.co/u/msylvestre)
#### Post date: [August 8, 2023, 6:44pm UTC](https://discuss.elastic.co/t/if-statement-in-winlogbeat-configuration/340393/3 "2023-08-08T18:44:35Z")

</div>

Thank you so much Andrew! Working like a charm!

Mathieu

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 5, 2023, 8:45pm UTC](https://discuss.elastic.co/t/if-statement-in-winlogbeat-configuration/340393/4 "2023-09-05T20:45:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.