# Ingest log if field exists

**URL:** <https://discuss.elastic.co/t/ingest-log-if-field-exists/364380>\
**Category:** Kibana\
**Created:** [August 5, 2024, 12:03pm UTC](https://discuss.elastic.co/t/ingest-log-if-field-exists/364380 "2024-08-05T12:03:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmartinez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmartinez/32/106337_2.png) [@mmartinez](https://discuss.elastic.co/u/mmartinez)\
**Post date:** [August 5, 2024, 12:03pm UTC](https://discuss.elastic.co/t/ingest-log-if-field-exists/364380/1 "2024-08-05T12:03:31Z")

</div>

Hello,

I'm trying to set a condition in my phpfpm pipeline that sends the log to a different index if field `log.context.extra.asyncapi.name` exists but is not doing anything. It keeps sending the log to the phpfpm index instead of asyncapi-phpfpm.  
This is the pipeline I'm using:

```auto
{
  "description": "Basic ingest pipeline for phpfpm index",
  "processors": [
    {
      "set":{
         "field":"_index",
         "value":"phpfpm"
      }
    },
    {
      "json": {
        "if" : "ctx.containsKey('message') && ctx.message.startsWith('{')",
        "field": "message",
        "target_field": "log"
      }
    },
    {
      "set":{
         "if": "ctx.containsKey('log.context.extra.asyncapi.name')",
         "field":"_index",
         "value":"asyncapi-phpfpm"
      }
    }
}

```

That field exists but is not redirecting the log to `asyncapi-phpfpm` index for some reason.

Any help will be very appreciated. Thanks

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [August 6, 2024, 5:43am UTC](https://discuss.elastic.co/t/ingest-log-if-field-exists/364380/2 "2024-08-06T05:43:37Z")

</div>

Hello Mario,

I think your `if`-condition is wrong. I think it needs to be `ctx?.log?.context?.extra?.asyncapi?.containsKey('name')`

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![kishorkumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorkumar/32/132930_2.png) [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\
**Post date:** [August 6, 2024, 7:03am UTC](https://discuss.elastic.co/t/ingest-log-if-field-exists/364380/3 "2024-08-06T07:03:45Z")

</div>

i think the condition is wrong try this by verifying that the name field exists and !=null and second thing that you should not directly add the \_index value as phpfpm try adding if the index value != asyncapi-phpfpm' this way both will be working perfectly

```auto
{
  "description": "Basic ingest pipeline for phpfpm index",
  "processors": [
    {
      "json": {
        "if": "ctx.containsKey('message') && ctx.message.startsWith('{')",
        "field": "message",
        "target_field": "log"
      }
    },
    {
      "set": {
        "if": "ctx.log?.context?.extra?.asyncapi?.name != null",
        "field": "_index",
        "value": "asyncapi-phpfpm"
      }
    },
    {
      "set": {
        "if": "ctx._index != 'asyncapi-phpfpm'",
        "field": "_index",
        "value": "phpfpm"
      }
    }
  ]
}

```