# Is this a right filter?

**URL:** <https://discuss.elastic.co/t/is-this-a-right-filter/291118>\
**Category:** Logstash\
**Created:** [December 7, 2021, 1:10pm UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118 "2021-12-07T13:10:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![smam](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@smam](https://discuss.elastic.co/u/smam)\
**Post date:** [December 7, 2021, 1:10pm UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118/1 "2021-12-07T13:10:39Z")

</div>

```auto
filter {
  if "warning" in "message" {
        mutate {
                add_field => { "error-field" => "An error occured" }
        }
  }
}

```

Is this right? Because it seems to not be working. If I open Elasticsearch and go into the index to search for the filter `if message is *warning*` I find some fields, but none contain the error-field.

I also tried it with

```auto
  if "warning" in [message] 
  if "warning" in [log_message]
  if "warning" in "log_message"
  

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 7, 2021, 1:26pm UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118/2 "2021-12-07T13:26:41Z")

</div>

You should use the conditional in this format:

```auto
if "warning" in [message] {
    your filters
}

```

This will work if you have the string _warning_ in the field `message`.

Can you share an example of your document that it is not working?

---

<div class="post-metadata">

**Author:** ![smam](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@smam](https://discuss.elastic.co/u/smam)\
**Post date:** [December 7, 2021, 2:05pm UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118/3 "2021-12-07T14:05:39Z")

</div>

> [@leandrojmp](#):
>
> `if "warning" in [message]`

```auto
Oct 21 15:21:44 M2 dis-f: pkt rx on ifd NULL unit 0
Oct 21 15:21:44 M2 fbc0 pkt rx on ifd NULL unit 0
Oct 21 15:21:46 M1 kernel: rtc4658je_rtc0: RTC ERROR(16): read failed for off:2(len:1)
Oct 21 15:21:46 M1 kernel: rtc4658je_rtc0: SETTIME failed for seconds: error 16
Oct 21 15:21:46 M1 kernel: warning: clock_settime failed (16), time-of-day clock not adjusted to system time

```

Here are some sample Lines, there is only one warning line. The other look similar to the ones above the warning failure.

Thanks for the help, I will let you know if I could make it work every moment.

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [December 7, 2021, 2:48pm UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118/4 "2021-12-07T14:48:14Z")

</div>

You may be best to create a grok pattern for your log entries to look for "warnings".

```auto
%{MONTH} %{MONTHDAY} %{TIME} (M1|M2) kernel: %{NOTSPACE:log_level}: %{GREEDYDATA:log_message}

```

Then you'll get output like this:

```auto
{
  "MONTH": [
    [
      "Oct"
    ]
  ],
  "MONTHDAY": [
    [
      "21"
    ]
  ],
  "TIME": [
    [
      "15:21:46"
    ]
  ],
  "HOUR": [
    [
      "15"
    ]
  ],
  "MINUTE": [
    [
      "21"
    ]
  ],
  "SECOND": [
    [
      "46"
    ]
  ],
  "log_level": [
    [
      "warning"
    ]
  ],
  "log_message": [
    [
      "clock_settime failed (16), time-of-day clock not adjusted to system time"
    ]
  ]
}

```

Then you can create a conditional for your warning message.

```auto
filter {
  if "warning" in [log_level] {
        mutate {
                add_field => { "error-field" => "An error occurred" }
        }
  }
}

```

---

<div class="post-metadata">

**Author:** ![smam](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@smam](https://discuss.elastic.co/u/smam)\
**Post date:** [December 9, 2021, 9:18am UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118/5 "2021-12-09T09:18:03Z")

</div>

That works just fine. Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 6, 2022, 9:18am UTC](https://discuss.elastic.co/t/is-this-a-right-filter/291118/6 "2022-01-06T09:18:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.