# Logstash filter fields in if conditions

**URL:** https://discuss.elastic.co/t/logstash-filter-fields-in-if-conditions/242717
**Category:** Logstash
**Created:** [July 27, 2020, 9:03am UTC](https://discuss.elastic.co/t/logstash-filter-fields-in-if-conditions/242717 "2020-07-27T09:03:37Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 27, 2020, 12:40pm UTC](https://discuss.elastic.co/t/logstash-filter-fields-in-if-conditions/242717/2 "2020-07-27T12:40:52Z")

</div>

There are many ways you could do. You can either do a if/else condition in output or within filter.  
I tend to do mostly within filter as it will be cleaner and modular

So an example would be

```auto
input {
    pipeline {
        address => os_nix_syslog_pipeline
    }
}

filter {
  grok {
    match => {
        message => "%{SYSLOG5424LINE}"
      }
  }

  if "syslog5424_host" == '127.0.0.1' {
    mutate {
      add_field => { "myhost" => "localhost" }
    }  
  } else {
    mutate {
      add_field => { "myhost" => "unknown" }
    }  
  }
}

output {
  elasticsearch {
    hosts => "http://localhost:9200"
    user => "elastic"
    password => "changeme"
    index => "os_%{myhost}-%{+YYYY.MM}"
  }
}

```

The idea here is

- Get the input from a pipeline or log. In this example, it is a linux\_syslog
- Grok to get the [linux\_syslog](https://github.com/elastic/elasticsearch/blob/7.8/libs/grok/src/main/resources/patterns/linux-syslog) paramters
- if the syslog\_host is `127.0.0.1`, its localhost and add a field called "myhost". If anything else, it is "unknown"
- Just pump the output based on that field

---

_[View the full topic](https://discuss.elastic.co/t/logstash-filter-fields-in-if-conditions/242717)._