# Logstash advanced pipeline examples

**URL:** <https://discuss.elastic.co/t/logstash-advanced-pipeline-examples/128389>\
**Category:** Logstash\
**Created:** [April 17, 2018, 2:57pm UTC](https://discuss.elastic.co/t/logstash-advanced-pipeline-examples/128389 "2018-04-17T14:57:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ezmani](https://avatars.discourse-cdn.com/v4/letter/e/7ea924/32.png) [@ezmani](https://discuss.elastic.co/u/ezmani)\
**Post date:** [April 17, 2018, 2:57pm UTC](https://discuss.elastic.co/t/logstash-advanced-pipeline-examples/128389/1 "2018-04-17T14:57:32Z")

</div>

Hi there,

I am attempting to construct a logstash pipeline managed via kibana (x-pack for logstash) for iis-logs import.

I am using [elastic's guide](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) to construct my filters.

per the documentation I can use

```auto
regexp: =~, !~ (checks a pattern on the right against a string value on the left)

```

Are there any examples any where as to what the right hand side values would look like? Or is there a website where I can see complex examples of pipeline conditional constructs?

I am trying to do something like the following.

```auto
if "IIS Logs" in [tags] and ("xxx1" in [tags] or "xxx2" in [tags]) {
        grok {
            match => {"message" => "<grok1>"}
        }
        mutate {
            add_field => { "indexname" => "iis-logs" }
        }
    } else if "IIS Logs" in [tags] and ("xxx1" not in [tags] and "xxx2" not in [tags]) {
        grok {
            match => {"message" => "<grok with different fields>"}
        }
        mutate {
            add_field => { "indexname" => "iis-logs" }
        }    
    }

```

Thanks much!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 17, 2018, 6:52pm UTC](https://discuss.elastic.co/t/logstash-advanced-pipeline-examples/128389/2 "2018-04-17T18:52:25Z")

</div>

> Are there any examples any where as to what the right hand side values would look like?

The patterns the documentation is talking about are regular expressions. There are countless examples of and tutorials for those.

---

<div class="post-metadata">

**Author:** ![ezmani](https://avatars.discourse-cdn.com/v4/letter/e/7ea924/32.png) [@ezmani](https://discuss.elastic.co/u/ezmani)\
**Post date:** [May 11, 2018, 11:29am UTC](https://discuss.elastic.co/t/logstash-advanced-pipeline-examples/128389/3 "2018-05-11T11:29:50Z")

</div>

Thanks! sorry for the delayed response!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2018, 11:29am UTC](https://discuss.elastic.co/t/logstash-advanced-pipeline-examples/128389/4 "2018-06-08T11:29:58Z")

</div>

Closed on June 8, 2018, 11:29am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.