# Logstash configure issue

**URL:** <https://discuss.elastic.co/t/logstash-configure-issue/114813>\
**Category:** Logstash\
**Created:** [January 10, 2018, 8:34am UTC](https://discuss.elastic.co/t/logstash-configure-issue/114813 "2018-01-10T08:34:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hsiuming](https://avatars.discourse-cdn.com/v4/letter/h/d78d45/32.png) [@hsiuming](https://discuss.elastic.co/u/hsiuming)\
**Post date:** [January 10, 2018, 8:34am UTC](https://discuss.elastic.co/t/logstash-configure-issue/114813/1 "2018-01-10T08:34:23Z")

</div>

Hello we now have a data is two layer in kibana json form.

In kibana we can see :  
{  
"\_index": "XXXXXX",  
"\_type": "pcap",  
"\_id": "XXXXXX",  
"\_version": X,  
.  
.  
.  
"layers": {  
"ip\_src": [  
"192.168.X.XX"  
],  
.  
.  
}  
.  
"@version": "X",  
"host": "XXXXX",

}

We send the data to kibana following the process:

log data-\>filebeat-\>logstash-\>elasticsearch

Now we want to add some filter condition in logstash.

When we set the if condition in logstash configure file :

if [type] == "pcap"  
{}

If the data meet the if condition ,logstash will execute the function in big parantheses.

But if i set the if condition:

if [layers][ip\_src] == "192.168.X.XX"  
{}

The if function will not execute.

Do we have the wrong if function setting?

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 12, 2018, 5:06pm UTC](https://discuss.elastic.co/t/logstash-configure-issue/114813/2 "2018-01-12T17:06:18Z")

</div>

ip\_src is an Array. Your conditional is trying to test whether an Array is equal to a String.

Try this (not tested):

```auto
if "192.168.X.XX" in [layers][ip_src] {

}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2018, 5:06pm UTC](https://discuss.elastic.co/t/logstash-configure-issue/114813/3 "2018-02-09T17:06:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.