# Logstash GROK If statement

**URL:** <https://discuss.elastic.co/t/logstash-grok-if-statement/93768>\
**Category:** Logstash\
**Created:** [July 19, 2017, 1:17pm UTC](https://discuss.elastic.co/t/logstash-grok-if-statement/93768 "2017-07-19T13:17:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nitin\_gupta](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\
**Post date:** [July 19, 2017, 1:17pm UTC](https://discuss.elastic.co/t/logstash-grok-if-statement/93768/1 "2017-07-19T13:17:26Z")

</div>

Hi,

I am trying to configure logstash and below is my filter configuration .

Capturing **event** in grok statement and then checking whether **event** is equal to condition  
but i am getting errors at **if[event]=**

is it possible to use if condition with event captured in grok statement ?

```
filter{
     if[source]=~"ftp.log"{
        grok{
         match=>{
                 "message"=>[
                 "\[%{TIMESTAMP_ISO8601:timestamp}\] ALL AUDIT: User \[%{GREEDYDATA:userId}\]\ %{GREEDYDATA:var} \[%{HOSTNAME:ip}\] %{GREEDYDATA:event}.",
                 "\[%{TIMESTAMP_ISO8601:timestamp}\] ALL AUDIT: User \[%{GREEDYDATA:userId}\]\ %{GREEDYDATA:event} \[%{GREEDYDATA:filename}\]."
							]
				}
				
				
				if[event]=~"retrieving file"{
						add_tag=>["Download"]
					}else if["event"]=~"storing file"{
						add_tag=>["Upload"]
					}else if["event"]=~"has logged in"{
						add_tag=>["Login"]			
				}
				add_tag=>["log_ftp"]
			}
			
			}
     }
```

---

<div class="post-metadata">

**Author:** ![Nitin\_gupta](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\
**Post date:** [July 19, 2017, 3:09pm UTC](https://discuss.elastic.co/t/logstash-grok-if-statement/93768/2 "2017-07-19T15:09:54Z")

</div>

working now  
now my if statements are outside of grok  
and also removed double quotes in "event"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2017, 3:09pm UTC](https://discuss.elastic.co/t/logstash-grok-if-statement/93768/3 "2017-08-16T15:09:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.