# Logstash filter conditionals

**URL:** <https://discuss.elastic.co/t/logstash-filter-conditionals/243005>\
**Category:** Logstash\
**Created:** [July 29, 2020, 6:35am UTC](https://discuss.elastic.co/t/logstash-filter-conditionals/243005 "2020-07-29T06:35:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![smm](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@smm](https://discuss.elastic.co/u/smm)\
**Post date:** [July 29, 2020, 6:35am UTC](https://discuss.elastic.co/t/logstash-filter-conditionals/243005/1 "2020-07-29T06:35:58Z")

</div>

Hi there,  
I have 2 simple questions reagarding this logstash conditionals example.  
I have found something like this:  
...  
if [fields][some\_id] {  
mutate {  
add\_field =\> {"some\_id" =\> "%{[fields][some\_id]}"}  
}  
}  
...

1. Here I have a conditional but nothing it is compared too - a bit strange. Does it mean: If some\_id has a key and therefore true? It would say: If the field some\_id does exist, then add this field?? It does not make much sense to me. But this example does work. Would you please explain it to me.

2. This fields is it a a common field / or a fixed, existing object? Since [fields] was not defined anywhere else in that conf file.  
Thank you and kind regards!

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 29, 2020, 6:59am UTC](https://discuss.elastic.co/t/logstash-filter-conditionals/243005/2 "2020-07-29T06:59:47Z")

</div>

1. Yes. It checks if the field exists because otherwise the new field would get the value `"%{[fields][some_id]}"` if the field doesn't exist. (One could also use the copy option of mutate for this task to avoid a wrong result.)
2. Does the data maybe come from filebeat? The default for fields that are added with filebeat is `fields`: [https://www.elastic.co/guide/en/beats/filebeat/current/add-fields.html](https://www.elastic.co/guide/en/beats/filebeat/current/add-fields.html)  
In general a field that you didn't define in your Logstash filters (except `@timestamp` and `@version`) must come from your input data. Either as part of the original data or additional information that has been added by the input plugin.

---

<div class="post-metadata">

**Author:** ![smm](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@smm](https://discuss.elastic.co/u/smm)\
**Post date:** [July 29, 2020, 8:05am UTC](https://discuss.elastic.co/t/logstash-filter-conditionals/243005/3 "2020-07-29T08:05:12Z")

</div>

Hello Jenni,  
thank you very much - very interesting comment! Regarding your second point:  
Yes, there is a beat input defined too in the logstash config like this:  
...  
beats {  
port =\> 5044  
add\_field =\> { "[@metadata][datatype]" =\> "beat" }  
}  
...  
That is why this definition in the filter also works:  
...  
if [@metadata][beat] == "filebeat"...  
...  
Great, thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2020, 8:05am UTC](https://discuss.elastic.co/t/logstash-filter-conditionals/243005/4 "2020-08-26T08:05:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.