# Logstash filter section - "if" condition doesn't work

**URL:** <https://discuss.elastic.co/t/logstash-filter-section-if-condition-doesnt-work/149459>\
**Category:** Logstash\
**Created:** [September 21, 2018, 1:00pm UTC](https://discuss.elastic.co/t/logstash-filter-section-if-condition-doesnt-work/149459 "2018-09-21T13:00:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ged](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ged/32/65761_2.png) [@Ged](https://discuss.elastic.co/u/Ged)\
**Post date:** [September 21, 2018, 1:00pm UTC](https://discuss.elastic.co/t/logstash-filter-section-if-condition-doesnt-work/149459/1 "2018-09-21T13:00:15Z")

</div>

Hi,

I have problem with dropping events on condition that one of fields has specific value set. Fields is extracted using xml filter plugin.  
According to below my understanding is all events except of those with xmlRequestType = "CreateRQ" or xmlRequestType = "CreateRS" should be dropped. So below example with CreateRQ should store value, but it doesn't.

Part of my filter section config:  
`
## parsing XML payload
if [xmlPayload] {
xml {
source => "xmlPayload"
store_xml => false # disable storing parsed xml
remove_namespaces => true
xpath => {
"local-name(/*)" => "xmlRequestType"
"(//@ClientCode)[1]" => "xmlClientCode"
"(//@ClientContextCode)[1]" => "xmlClientContextCode"
}
}
}
# drop anything except of CreateRQ/CreateRS
if [xmlRequestType] not in "[CreateRQ","CreateRS"]	{
drop{}
}
`  
and rubydebug output when above condition is commented  
`
{
"xmlRequestType" => [
[0] CreateRQ"
],
"path" => "/apps/elk/logstash/pdc.log",
"xmlClientContextCode" => [
[0] "GCL"
],
"xmlClientCode" => [
[0] "TN"
],
"@version" => "1",
"@timestamp" => 2018-09-21T12:27:37.020Z
}
`  
Thanks in advance !

---

<div class="post-metadata">

**Author:** ![Ged](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ged/32/65761_2.png) [@Ged](https://discuss.elastic.co/u/Ged)\
**Post date:** [September 21, 2018, 2:17pm UTC](https://discuss.elastic.co/t/logstash-filter-section-if-condition-doesnt-work/149459/2 "2018-09-21T14:17:17Z")

</div>

Resolved.  
xmlRequestType is and array in this case so i need to use [xmlRequestType][0] in my condition.

Other thing is i've tried to set  
force\_array =\> false  
for xml filter plugin, but looks like it has no effect.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2018, 2:17pm UTC](https://discuss.elastic.co/t/logstash-filter-section-if-condition-doesnt-work/149459/3 "2018-10-19T14:17:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.