# Logstash filter combine

**URL:** https://discuss.elastic.co/t/logstash-filter-combine/228764
**Category:** Logstash
**Created:** [April 19, 2020, 10:22pm UTC](https://discuss.elastic.co/t/logstash-filter-combine/228764 "2020-04-19T22:22:06Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [April 19, 2020, 10:22pm UTC](https://discuss.elastic.co/t/logstash-filter-combine/228764/1 "2020-04-19T22:22:06Z")

</div>

Is it possible to use match and mutate in the same filter?

Message is in the following format:

`<164>%ASA-4-722051: Group <DfltGrpPolicy> User <test_user> IP <test_ip> IPv4 Address <test_ip> IPv6 address <::> assigned to session`

```
filter {
               if [type] == "cisco-asa" and "ASA-4-722051" in [message] {
               grok {
               match => {
               "message" => "<164>%ASA-4-722051: Group <%{USERNAME:Group}> User <%{NOTSPACE:Username}> IP <%{IP:client_ip}> IPv4 Address <%{IP:client_vpn}> IPv6 address <%{IP:client_vpn_IPv6}> assigned to session"
               }}}}

filter {
       if [type] == "cisco-asa" and "ASA-4-722051" in [message] {
       mutate { remove_field => ["client_vpn_IPv6"] }
       }}

```

Thanks

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 19, 2020, 11:51pm UTC](https://discuss.elastic.co/t/logstash-filter-combine/228764/2 "2020-04-19T23:51:06Z")

</div>

> [@VamPikmin](#):
>
> Is it possible to use match and mutate in the same filter?

A filter {} section can contain pretty much any number and variety of filters. So the answer is yes.

---

<div class="post-metadata">

### Author: ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [April 20, 2020, 12:53am UTC](https://discuss.elastic.co/t/logstash-filter-combine/228764/3 "2020-04-20T00:53:59Z")

</div>

Thanks @Badger

I was trying to use the mutate filter inside grok...

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 18, 2020, 12:54am UTC](https://discuss.elastic.co/t/logstash-filter-combine/228764/4 "2020-05-18T00:54:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.