# IF syntax

**URL:** <https://discuss.elastic.co/t/if-syntax/141852>\
**Category:** Logstash\
**Created:** [July 26, 2018, 10:39pm UTC](https://discuss.elastic.co/t/if-syntax/141852 "2018-07-26T22:39:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [July 26, 2018, 10:39pm UTC](https://discuss.elastic.co/t/if-syntax/141852/1 "2018-07-26T22:39:38Z")

</div>

I seem to be having issues with getting an if statement to function, below are the syntaxs I have tried on 6.2.3 but neither of them have an effect. The event is passing through but it's not getting tagged. I have not turned on debug yet...just wanting another set of eyes to verify syntax first or suggest a better method to accomplish this.

```
if [field] =~ "(1|2|3)" {
  mutate {
    add_tag => ["tag1", "tag2"]
  }
}

if [field] in [1,2,3] {
  mutate {
    add_tag => ["tag1", "tag2"]
  }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 27, 2018, 6:01pm UTC](https://discuss.elastic.co/t/if-syntax/141852/2 "2018-07-27T18:01:50Z")

</div>

Either one can be correct depending on what `field` contains.

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [July 27, 2018, 6:42pm UTC](https://discuss.elastic.co/t/if-syntax/141852/3 "2018-07-27T18:42:02Z")

</div>

Ya, I kinda figured that was coming, lol.

The field is the `event\_id' field collected by the winlog beats agent. Looking at the JSON of the event, the field isn’t embedded in another field….so I am a bit lost on where the failure is. The exact config line looks like below. I'm also aware the json in the picture isn't going to match to the if statement below but where event ID does equal a value below, the tag isn't applied.

`if [event_id] =~ "(529|530|531|532|533|534|535|536|537|538|539|4625|4771)" {`

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/8/3/83b18d12b957b67288e49649b1a6df2e3dcd4ffa.JPG)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 27, 2018, 6:55pm UTC](https://discuss.elastic.co/t/if-syntax/141852/4 "2018-07-27T18:55:38Z")

</div>

Okay, so the field contains an integer. Then the second suggestion you made should work fine and should be more efficient than the regexp-based option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2018, 7:05pm UTC](https://discuss.elastic.co/t/if-syntax/141852/5 "2018-08-24T19:05:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.