# IF with multiple OR **URL:** \ **Category:** Logstash\ **Created:** [March 14, 2018, 3:08pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928 "2018-03-14T15:08:20Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [March 14, 2018, 3:08pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/1 "2018-03-14T15:08:20Z")
I have multiple fields that I need to check and, if they meet a shared value, it needs to be mutated. Is it possible to do something like this: ``` if "pass" in [field1] or [field2] or [field3] { mutate { replace "%{FieldThatMeetsEvaluation}" => "Pass" } } ``` So I guess two questions here: 1. Can I use a single if statement to check multiple fields for a value being present? 2. Is it possible to reference the field(s) that match later on run a filter on the field? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [March 15, 2018, 7:56pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/2 "2018-03-15T19:56:41Z")
Bump ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 15, 2018, 8:05pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/3 "2018-03-15T20:05:14Z")
> Can I use a single if statement to check multiple fields for a value being present? ``` if "pass" in [field1] or "pass" in [field2] or "pass" in [field3] { ``` > Is it possible to reference the field(s) that match later on run a filter on the field? No. ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [March 15, 2018, 8:30pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/4 "2018-03-15T20:30:07Z")
So I would have to write something like? ``` filter { if "pass" in [field1] { mutate { replace => {"field1" => "Pass"} } } if "pass" in [field2] { mutate { replace => {"field2" => "Pass"} } } if "pass" in [field3] { mutate { replace => {"field3" => "Pass"} } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 15, 2018, 8:37pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/5 "2018-03-15T20:37:59Z")
It might be possible to use add\_field to build a string containing the three fields as key=value pairs, then use grok to do a match for SOMEPATTERN=Pass, then a replace based on the value captured by grok. But it will make your eyes bleed. ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [March 15, 2018, 8:41pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/6 "2018-03-15T20:41:22Z")
> [@Badger](#): > > It might be possible to use add\_field to build a string containing the three fields as key=value pairs, then use grok to do a match for SOMEPATTERN=Pass, then a replace based on the value captured by grok. > > But it will make your eyes bleed. lol, just your explanation melts my brain. I think the deciding factor would be, which method can be processed faster. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 15, 2018, 9:28pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/7 "2018-03-15T21:28:50Z")
Thankfully it does not work. I can get a field name into a field called whichone, but I cannot get the left side of a mutate/replace to reference it. BTW '"pass" in [field1]' is almost certainly not what you want. Are you looking for '"[field1] =~ "pass"', perhaps? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [March 15, 2018, 9:43pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/8 "2018-03-15T21:43:29Z")
My field(s) SHOULD have one of two values, `pass` or `fail`. Unfortunately, some of the data that gets ingested also has `Pass`. This throws off visualizations, where for example, pie graphs have three slices instead of two. ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8e3fa6a93ccea1e003359f65691dcb9155ce096a.jpg) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 15, 2018, 10:19pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/9 "2018-03-15T22:19:22Z")
So mutate/lowercase would fix your issue? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [March 16, 2018, 11:45pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/10 "2018-03-16T23:45:15Z")
> [@Badger](#): > > So mutate/lowercase would fix your issue? Yes.....yes it would.....lol. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2018, 11:45pm UTC](https://discuss.elastic.co/t/if-with-multiple-or/123928/11 "2018-04-13T23:45:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.