# Logstash complex IF condition
**URL:** https://discuss.elastic.co/t/logstash-complex-if-condition/290047
**Category:** Logstash
**Created:** [November 24, 2021, 11:00am UTC](https://discuss.elastic.co/t/logstash-complex-if-condition/290047 "2021-11-24T11:00:48Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Jan\_Kabelka](https://discuss.elastic.co/u/Jan_Kabelka)
#### Post date: [November 24, 2021, 11:00am UTC](https://discuss.elastic.co/t/logstash-complex-if-condition/290047/1 "2021-11-24T11:00:48Z")
Dear, would you know how to write complex IF condition on Logstash? I would like to add new tag once two fields have different values, except of some combinations of them. What works:
```auto
if [event][code] == "1" and [processtemptemp] and [processpetemp] and "original_file_name_missing" not in [tags] {
if ( [processtemptemp] != "nltest.exe" and [processpetemp] != "nltestrk.exe" ) {
if [processtemptemp] != [processpetemp] {
mutate {
add_tag => ["file_rename"]
tag_on_failure => ["_add_tag_failure_file_rename"]
}
}
}
}
```
What does not work:
```auto
if [event][code] == "1" and [processtemptemp] and [processpetemp] and "original_file_name_missing" not in [tags] {
if (( [processtemptemp] != "nltest.exe" and [processpetemp] != "nltestrk.exe" ) or ( [processtemptemp] != "schtasks.exe" and [processpetemp] != "sctasks.exe" )) {
if [processtemptemp] != [processpetemp] {
mutate {
add_tag => ["file_rename"]
tag_on_failure => ["_add_tag_failure_file_rename"]
}
}
}
}
```
I tried also IF/ELSE IF, but also does not work.
Any idea how to solve it? Thank you!
---
### Author:  [@Jan\_Kabelka](https://discuss.elastic.co/u/Jan_Kabelka)
#### Post date: [November 24, 2021, 1:10pm UTC](https://discuss.elastic.co/t/logstash-complex-if-condition/290047/2 "2021-11-24T13:10:55Z")
Solved as below even if I do not like it:)
```auto
if "file_rename" in [tags] and [processtemptemp] == "nltest.exe" and [processpetemp] == "nltestrk.exe" {
mutate {
remove_tag => ["file_rename"]
}
}
if "file_rename" in [tags] and [processtemptemp] == "schtasks.exe" and [processpetemp] == "sctasks.exe" {
mutate {
remove_tag => ["file_rename"]
}
}
if "file_rename" in [tags] and [processtemptemp] == "microsoftedgeupdate.exe" and [processpetemp] == "msedgeupdate.dll" {
mutate {
remove_tag => ["file_rename"]
}
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 24, 2021, 2:24pm UTC](https://discuss.elastic.co/t/logstash-complex-if-condition/290047/3 "2021-11-24T14:24:26Z")
I think you can try something like this:
```auto
if "file_rename" in [tags] and [processtemptemp] in ["nltest.exe", "schtasks.exe", "microsoftedgeupdate.exe"] and [processpetemp] in ["nltestrk.exe","sctasks.exe","msedgeupdate.dll"] {
mutate {
remove_tag => ["file_rename"]
}
}
```
---
### Author:  [@Jan\_Kabelka](https://discuss.elastic.co/u/Jan_Kabelka)
#### Post date: [November 26, 2021, 4:17pm UTC](https://discuss.elastic.co/t/logstash-complex-if-condition/290047/4 "2021-11-26T16:17:23Z")
Thank you, but then I would combine eg.
"processtemptemp" : "nltest.exe" AND "processpetemp" :"sctasks.exe"
... which I do not want to... I implemented approach below:
```auto
# FP reduction
if "file_rename" in [tags] and [processtemptemp] == "nltest.exe" and [processpetemp] == "nltestrk.exe" {
mutate {
remove_tag => ["file_rename"]
}
}
if "file_rename" in [tags] and [processtemptemp] == "schtasks.exe" and [processpetemp] == "sctasks.exe" {
mutate {
remove_tag => ["file_rename"]
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 24, 2021, 4:17pm UTC](https://discuss.elastic.co/t/logstash-complex-if-condition/290047/5 "2021-12-24T16:17:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.