# Logstash configuration input error with if statement **URL:** \ **Category:** Logstash\ **Created:** [August 23, 2020, 12:55pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019 "2020-08-23T12:55:19Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![anon56147639](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Post date:** [August 23, 2020, 12:55pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/1 "2020-08-23T12:55:19Z")
Hi everyone, I'm trying to create a pipeline in logstash which receives CEF events and other input from Filebeat. Since not all input is in CEF format, I created an IF-statement. My logstash.conf looks like this: ```auto beats { port => 5044 if "forcepoint" in [tags] {codec => cef {}} } } output { elasticsearch { hosts => ["localhost:9200"] index => "logstash-%{[fields][flavor]}-%{+YYYY.MM.dd}" } # stdout { codec => rubydebug } } ``` But when I check the config using config test and exit, I get the following error: ```auto [FATAL] 2020-08-23 14:39:47.004 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of [\t\r\n], "#", "=>" at line 6, column 14 (byte 129) after input { beats { port => 5044 if [ERROR] 2020-08-23 14:39:47.006 [LogStash::Runner] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ``` When I uncomment the if statement and run the config test again, it says the config is OK. So I guess there must be a mistake with the formatting of the if statement. Can someone please tell me what I need to change? Or is it even possible to use the codec plugin and conditional statements in the input section? Any help is appreciated! ---
**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Post date:** [August 23, 2020, 1:20pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/2 "2020-08-23T13:20:37Z")
Please set log.level to debug and run again to see more debug log. ---
**Author:** ![anon56147639](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Post date:** [August 23, 2020, 1:50pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/3 "2020-08-23T13:50:52Z")
Sorry, some part of the error message was missing. I updated my post. ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [August 23, 2020, 3:40pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/4 "2020-08-23T15:40:00Z")
Try putting your [condition statements](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) in the filter block and not the input. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 23, 2020, 3:57pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/5 "2020-08-23T15:57:11Z")
You cannot use a conditional like that inside an input configuration. See [this](https://discuss.elastic.co/t/filter-cef/181215/5) thread for a way to do this using multiple pipelines. ---
**Author:** ![anon56147639](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Post date:** [August 23, 2020, 4:50pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/6 "2020-08-23T16:50:42Z")
Thanks for the suggestion! I tried this: ```auto filter { if "forcepoint" in [tags] { codec => cef } ``` But it gives me an error again. ```auto [FATAL] 2020-08-23 18:45:24.966 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of [\t\r\n], "#", "{" at line 17, column 11 (byte 432) after filter { if "forcepoint" in [tags] { codec ``` ---
**Author:** ![anon56147639](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Post date:** [August 23, 2020, 5:08pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/7 "2020-08-23T17:08:52Z")
Thank you for the help! I'm not quite understanding your solution. Do you basically send it from one pipeline to another? My problem is that the message field is in CEF format. I'm sorry if the question sounds silly, I'm new to ElasticStack. BTW: Do you have experience with the decode\_cef processor in Filebeat? Could that also be a option? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 23, 2020, 5:45pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/8 "2020-08-23T17:45:17Z")
A codec can only be used on an input. The idea is that you accept the events using a beats input, then in the output section, if they have that "forcepoint" tag you can use a tcp output to send them to another pipeline that has a tcp input with a cef codec. That second pipeline can then send the decoded events to elasticsearch. ---
**Author:** ![anon56147639](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Post date:** [August 23, 2020, 7:07pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/9 "2020-08-23T19:07:43Z")
Ok, got it now. Thank you! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 23, 2020, 11:32pm UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/10 "2020-08-23T23:32:18Z")
Note that you could do it using a single pipeline, but this is a terrible idea, since if you get anything wrong it sets up an infinite loop, like this ``` input { beats { port => 5044 } tcp { port => 5144 codec => cef {} } } output { if "forcepoint" in [tags] { tcp { port => 5144 } } else { elasticsearch { ... } } } ``` Where you might get away with ``` input { beats { port => 5044 } tcp { port => 5144 codec => cef {} tags => ["decoded"] } } output { if "forcepoint" in [tags] and "decoded" not in [tags] { tcp { port => 5144 } } else { elasticsearch { ... } } } ``` ---
**Author:** ![anon56147639](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@anon56147639](https://discuss.elastic.co/u/anon56147639)\ **Post date:** [August 24, 2020, 9:11am UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/11 "2020-08-24T09:11:25Z")
Yes, that's not a good idea. I think the solution with two pipelines is the only suitable one. I'm also thinking about dropping Filebeat and sending the logs from Forcepoint via TCP/UDP directly to Logstash. But I'm not sure if that's an option as I'm not responsible for the firewalls. In case someone is having the same issues, I also found this solution: [https://gist.github.com/mzpqnxow/85a95010bedf8915056582fcfa34c3e7](https://gist.github.com/mzpqnxow/85a95010bedf8915056582fcfa34c3e7) But I haven't tried it yet. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 21, 2020, 9:11am UTC](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/12 "2020-09-21T09:11:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.