# Logstash 6.4.1 Conditional Filter Problem

**URL:** <https://discuss.elastic.co/t/logstash-6-4-1-conditional-filter-problem/154193>\
**Category:** Logstash\
**Created:** [October 26, 2018, 11:55am UTC](https://discuss.elastic.co/t/logstash-6-4-1-conditional-filter-problem/154193 "2018-10-26T11:55:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![uher3805](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/uher3805/32/49121_2.png) [@uher3805](https://discuss.elastic.co/u/uher3805)\
**Post date:** [October 26, 2018, 11:55am UTC](https://discuss.elastic.co/t/logstash-6-4-1-conditional-filter-problem/154193/1 "2018-10-26T11:55:19Z")

</div>

## Hi, I am suddently confronted with this error in my ELK Installation. I have set up a filter based on the Content of an extra field I add in filebeat. I cannot get this to work, help is appreciated! Thanks, Udo

**/var/log/logstash/logstash-plain.log:**  
[2018-10-26T13:46:19,699][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:01pip, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, ,, ] at line 12, column 35 (byte 232) after filter {\n if [fields.logart] == "fhem" {\n grok { match =\> ["message" ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:in`block in converge\_state'"]}

* * *

**/etc/logstash/conf.d/filter.conf:**

input {  
beats {  
port =\> 5044  
ssl =\> false  
#ssl\_certificate =\> "/etc/pki/client/cert.pem"  
#ssl\_key =\> "/etc/pki/client/key.pem"  
}  
}

filter {  
if [fields.logart] == "fhem" {  
grok { match =\> ["message" =\> "%{SYSLOGPROG:fh\_datetime} %{HOSTNAME:fh\_device} %{JAVALOGMESSAGE:fh\_message}"] }  
date {  
match =\> ["fh\_datetime", "yyyy-MM-dd\_HH:mm:ss", "ISO8601"]  
#match =\> ["timestamp\_string", "ISO8601"]  
target =\> "@timestamp"  
timezone =\> "Europe/Zurich"  
add\_tag =\> ["timecheck"]  
}  
}  
else  
grok { match =\> ["message" =\> "%{SYSLOGPROG:fh\_datetime} %{HOSTNAME:fh\_device} %{JAVALOGMESSAGE:fh\_message}"]  
add\_tag =\> ["elsecheck"] }  
}

output {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
# sniffing =\> true  
# manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM}"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 27, 2018, 9:44am UTC](https://discuss.elastic.co/t/logstash-6-4-1-conditional-filter-problem/154193/2 "2018-10-27T09:44:09Z")

</div>

`[fields][logart]`, not `[fields.logart]`. See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html).

---

<div class="post-metadata">

**Author:** ![uher3805](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/uher3805/32/49121_2.png) [@uher3805](https://discuss.elastic.co/u/uher3805)\
**Post date:** [October 28, 2018, 8:09pm UTC](https://discuss.elastic.co/t/logstash-6-4-1-conditional-filter-problem/154193/3 "2018-10-28T20:09:22Z")

</div>

Many thanks Magnus!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 25, 2018, 8:09pm UTC](https://discuss.elastic.co/t/logstash-6-4-1-conditional-filter-problem/154193/4 "2018-11-25T20:09:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.