# Kv filter doubts
**URL:** https://discuss.elastic.co/t/kv-filter-doubts/136846
**Category:** Logstash
**Created:** [June 21, 2018, 12:27pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846 "2018-06-21T12:27:25Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [June 21, 2018, 12:27pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/1 "2018-06-21T12:27:25Z")
Upon filtering the fields in kvs, can if or any other conditional statemnts be used on the keys and values. If so, how?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 21, 2018, 12:28pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/2 "2018-06-21T12:28:27Z")
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [June 21, 2018, 1:45pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/3 "2018-06-21T13:45:46Z")
Hi Magnus but in the if statements how do you specify the keys/values as a condition
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [June 21, 2018, 1:49pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/4 "2018-06-21T13:49:59Z")
Let say the snippet is "error":"1" , "usrname:"tom" If i pass it across kv fliter i get all these four fields separately. Now i want to specify if the error is 1, then network is down, error is 2 sotware is out dated (just for an example); then how do i use the use if statemnt after writinga a kv filter
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 21, 2018, 1:51pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/5 "2018-06-21T13:51:56Z")
There are several examples of just that in the Conditionals section of the page I linked to.
---
### Author:  [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [June 21, 2018, 2:05pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/6 "2018-06-21T14:05:17Z")
For an enumeration such as your example you can use the translate filter.
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [June 25, 2018, 7:18am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/7 "2018-06-25T07:18:14Z")
if conditions works fine with the most. But if followed by a key , it doesnt work.
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [June 25, 2018, 7:20am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/8 "2018-06-25T07:20:08Z")
can if statments be used in the filter section but outside the mutate section.?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 25, 2018, 7:51am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/9 "2018-06-25T07:51:33Z")
> if conditions works fine with the most. But if followed by a key , it doesnt work.
I don't understand what you mean. Please always give examples instead of describing things with words.
> can if statments be used in the filter section but outside the mutate section.?
Yes.
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [June 25, 2018, 10:06am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/10 "2018-06-25T10:06:03Z")
I tried to use else statement in filter section. It threwan error.
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [June 25, 2018, 10:06am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/11 "2018-06-25T10:06:14Z")
thanks
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [June 25, 2018, 10:08am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/12 "2018-06-25T10:08:54Z")
error reads as "Coudnt find any plug in named else"
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 25, 2018, 10:26am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/13 "2018-06-25T10:26:34Z")
> error reads as "Coudnt find any plug in named else"
Then you used the wrong syntax, got your braces mixed up, or something else.
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [July 3, 2018, 9:27am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/14 "2018-07-03T09:27:47Z")
yes i have mixed up with double quotes
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [July 3, 2018, 9:30am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/15 "2018-07-03T09:30:03Z")
Hi Magnus
How do i make a search case insensitive.
For example, The input text is as follows : if statuscode=001 or StatusCode=001, StaTUSCode=001. I have to design a filter that can pick up any combination of statuscode irrrespective of its case.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 3, 2018, 9:56am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/16 "2018-07-03T09:56:04Z")
Wouldn't the kv filter's `transform_key` option help?
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [July 3, 2018, 10:26am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/17 "2018-07-03T10:26:58Z")
When i used transform\_key, i obtained the following error
Unknown setting 'transform\_key' for kv {:level=\>:error}
Error: Something is wrong with your configuration. {:level=\>:error}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 3, 2018, 10:57am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/18 "2018-07-03T10:57:08Z")
You need to upgrade your kv plugin. If your version of Logstash is too old you may have to upgrade Logstash as well.
---
### Author:  [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)
#### Post date: [July 3, 2018, 11:28am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/19 "2018-07-03T11:28:37Z")
is there a command to upgade kvplugin and logstash . Is the Upgrading kv plugin is different from upgrading logstash?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 3, 2018, 1:33pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/20 "2018-07-03T13:33:47Z")
The Logstash documentation describes how to upgrade individual plugins.
[Next page](https://discuss.elastic.co/t/kv-filter-doubts/136846.md?page=2)