# Logical expression in pipeline

**URL:** https://discuss.elastic.co/t/logical-expression-in-pipeline/112621
**Category:** Logstash
**Created:** [December 20, 2017, 11:17am UTC](https://discuss.elastic.co/t/logical-expression-in-pipeline/112621 "2017-12-20T11:17:17Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![bodi4](https://avatars.discourse-cdn.com/v4/letter/b/57b2e6/32.png) [@bodi4](https://discuss.elastic.co/u/bodi4)
#### Post date: [December 20, 2017, 11:17am UTC](https://discuss.elastic.co/t/logical-expression-in-pipeline/112621/1 "2017-12-20T11:17:17Z")

</div>

Hi  
could someone explain logical expression in pipeline? The case is, for example Output section:

output {  
if "C" in [tags] and [filed\_A] = A or "C" in [tags] and [filed\_B] = B  
elasticsearch {}  
}

Second match group doesn't work. Logstash won't catch event.  
What would be right syntax to use matching in tags and fields?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 20, 2017, 11:22am UTC](https://discuss.elastic.co/t/logical-expression-in-pipeline/112621/2 "2017-12-20T11:22:35Z")

</div>

The equality operator is `==`, not `=`.

[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)

---

<div class="post-metadata">

### Author: ![bodi4](https://avatars.discourse-cdn.com/v4/letter/b/57b2e6/32.png) [@bodi4](https://discuss.elastic.co/u/bodi4)
#### Post date: [December 20, 2017, 11:38am UTC](https://discuss.elastic.co/t/logical-expression-in-pipeline/112621/3 "2017-12-20T11:38:07Z")

</div>

My bad.  
I'm using == But it doesn't solve problem.  
Event won't go to specified index.

Even more, if using  
"C" in [tags]  
more that 1 time in expression, the whole expression doesn't work.

So, do I have to use several elseif constructions with the same elasticsearch output configuration?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2018, 11:38am UTC](https://discuss.elastic.co/t/logical-expression-in-pipeline/112621/4 "2018-01-17T11:38:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
