# Logstash filter condition statement not working as expected

**URL:** <https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424>\
**Category:** Logstash\
**Created:** [January 7, 2018, 8:50pm UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424 "2018-01-07T20:50:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![shankar1](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@shankar1](https://discuss.elastic.co/u/shankar1)\
**Post date:** [January 7, 2018, 8:50pm UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424/1 "2018-01-07T20:50:15Z")

</div>

**Version Used:**  
Logstash 5.5.0

Data Flow -\> Filebeat (5.5.0)\_ Logstash 5.5.0\_Elasticsearch 5.5.0

**Input Case1:**

> ```
> <tag1></tag1><tag2></tag2><Unique>Data 1<Unique>
> <tag3></tag3><tag4></tag4>
> 
> ```

**Input Case 2:**

> ```
> <tag1></tag1><tag2></tag2><Distinct Tag="1">Data 2</Distinct>
> <tag3></tag3><tag4></tag4>
> 
> ```

**Input Case 3:**

> ```
> <tag1></tag1><tag2></tag2><Unique>Data 1</Unique>
> <tag3></tag3><tag4></tag4><Distinct Tag="1">Data 2</Distinct>
> <tag5></tag5>
> 
> ```

Logstash Filter  
Expected Output : Extract "Unique" tag Data, if it is not present then extract "Distinct Tag="1" tagdata

Logstash Yml:

> ```
> filter {
> grok {
> patterns_dir => "./patterns"
> match => ["message", "<Unique>%{GREEDYDATA:Product_ID}</Unique>"]
> }
> if [Product_ID] ==[]{
> grok {
> patterns_dir => "./patterns"
> match => ["message", '<Distinct Tag="1" %{DATA:namespace}>%{GREEDYDATA:Product_ID}</Distinct>']
> }
> }
> }
> }
> filter {  
> if "_grokparsefailure" in [tags] {
> drop { }
> }
> 
> ```

Current Output :  
The second match never occurs. (Distinct Tag="1" )  
Case 2 Fails. If Distinct Tag is used in one grok separately, it work.

I even tried -\>

> if ![Product\_ID]  
> #still not working

---

<div class="post-metadata">

**Author:** ![arisbanach](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Post date:** [January 7, 2018, 9:27pm UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424/2 "2018-01-07T21:27:22Z")

</div>

Is it because you have a space in your `<Unique>` tag in the doc that has a `<Distinct>` tag too?

---

<div class="post-metadata">

**Author:** ![shankar1](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@shankar1](https://discuss.elastic.co/u/shankar1)\
**Post date:** [January 8, 2018, 4:36am UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424/3 "2018-01-08T04:36:46Z")

</div>

Sorry, That space was not intentional. Can you check it again now.  
Input case 2 if failing and not case 3 as it has`<Unique>` Tag

---

<div class="post-metadata">

**Author:** ![arisbanach](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Post date:** [January 8, 2018, 4:55am UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424/4 "2018-01-08T04:55:16Z")

</div>

Can you post your custom pattern files?

---

<div class="post-metadata">

**Author:** ![shankar1](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@shankar1](https://discuss.elastic.co/u/shankar1)\
**Post date:** [January 8, 2018, 5:55am UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424/5 "2018-01-08T05:55:29Z")

</div>

I'm using the default`"grok-patterns"`. I have not added any pattern.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 8, 2018, 7:19am UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424/6 "2018-01-08T07:19:26Z")

</div>

> URGENT HELP

If you'd like an answer within a specific window then we can provide support with SLAs. Otherwise please have patience 🙂

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 8, 2018, 8:17am UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424/7 "2018-01-08T08:17:35Z")

</div>

Show an example document that exhibits the problem. Copy/paste from Kibana's JSON or use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2018, 8:17am UTC](https://discuss.elastic.co/t/logstash-filter-condition-statement-not-working-as-expected/114424/8 "2018-02-05T08:17:36Z")

</div>

Closed on February 5, 2018, 8:17am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.