# Logs that do not match the Filter with IF statement
**URL:** https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247
**Category:** Logstash
**Created:** [March 13, 2016, 8:44am UTC](https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247 "2016-03-13T08:44:54Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Hans](https://discuss.elastic.co/u/Hans)
#### Post date: [March 13, 2016, 8:44am UTC](https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247/1 "2016-03-13T08:44:54Z")
I have different filters for different fields in the messages and separate them with if statements. Now I have been trying to add one final section where none of the logs match and try to filter these through generic fields. I have tried with the else statement however this adds the No\_Filter to all logs. Could someone maybe assist on how to add a final filter for all logs that do not match the initial one? Here is a shortened example:
`filter {
if "10.10.10.12" in [message] {
mutate {
add\_tag =\> "JUNIPER"
}
}
if [message] =~ "RT\_FLOW\_SESSION\_CLOSE" {
mutate {
add\_tag =\> "FLOWCLOSE"
}
}
if [message] =~ "RT\_FLOW\_SESSION\_DENY" {
mutate {
add\_tag =\> "FLOWDENY"
}
}
if [message] =~ "FLOW\_REASSEMBLE\_FAIL" {
mutate {
add\_tag =\> "FLOWFAIL"
}
}
if [message] =~ "RT\_SCREEN\*" {
mutate {
add\_tag =\> "RT\_SCREEN"
}
}
if [message] =~ "sshd" {
mutate {
add\_tag =\> "sshd"
}
}
else {
mutate {
add\_tag =\> "No\_Filter"
}
}'
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 14, 2016, 3:57am UTC](https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247/2 "2016-03-14T03:57:19Z")
That appears right, is it not working, what are you seeing?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 14, 2016, 6:36am UTC](https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247/3 "2016-03-14T06:36:05Z")
The `else` block only applies to the list `if` block, i.e. any event not matching _that_ conditional is going to get the No\_Filter tag. You need to follow this pattern:
```auto
if ... {
...
} else if ... {
...
} else {
...
}
```
---
### Author:  [@Hans](https://discuss.elastic.co/u/Hans)
#### Post date: [March 14, 2016, 5:10pm UTC](https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247/4 "2016-03-14T17:10:21Z")
Thank you for the response. When adding a tag with the if statements once the else is hit all logs are tagged with the No\_Filter. Maybe I am doing it wrong, here is what I did:
`filter {
if "10.10.10.12" in [message] {
mutate {
add\_tag =\> "JUNIPER"
}
}
if [message] =~ "RT\_FLOW\_SESSION\_CLOSE" {
mutate {
add\_tag =\> "FLOWCLOSE"
}
}
if [message] =~ "RT\_FLOW\_SESSION\_DENY" {
mutate {
add\_tag =\> "FLOWDENY"
}
}
if [message] =~ "FLOW\_REASSEMBLE\_FAIL" {
mutate {
add\_tag =\> "FLOWFAIL"
}
}
if [message] =~ "RT\_SCREEN\*" {
mutate {
add\_tag =\> "RT\_SCREEN"
}
}
else if [message] =~ "sshd" {
mutate {
add\_tag =\> "sshd"
}
}
else {
mutate {
add\_tag =\> "No\_Filter"
}
}'
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 14, 2016, 6:29pm UTC](https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247/5 "2016-03-14T18:29:24Z")
You need to insert "else" before "if" in all places except the first "if". As it stands, all events except RT\_SCREEN and sshd ones are going to get the No\_Filter tag.
---
### Author:  [@Hans](https://discuss.elastic.co/u/Hans)
#### Post date: [March 14, 2016, 6:44pm UTC](https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247/6 "2016-03-14T18:44:59Z")
Thank you, that works, much appreciated
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/logs-that-do-not-match-the-filter-with-if-statement/44247/7 "2017-07-06T05:07:05Z")