# Logstash if condition issue **URL:** \ **Category:** Logstash\ **Created:** [October 31, 2017, 7:15am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843 "2017-10-31T07:15:00Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ruranga](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@ruranga](https://discuss.elastic.co/u/ruranga)\ **Post date:** [October 31, 2017, 7:15am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/1 "2017-10-31T07:15:01Z")
I have configured logstash filter as follows. But following filed " **NFC\_APP\_TYPE**" (newly added filed by using a if condition) doesn't appear in Kibana dash board filter{ ......... if [AppCode] == "505050" { mutate {add\_field =\> ["NFC\_APP\_TYPE", "SEMA"]} }else if [AppCode] == "404040" { mutate {add\_field =\> ["NFC\_APP\_TYPE", "TRAVEL WP"]} }else{ } } But filed called AppCode appears as following picture ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2fff9f471c557204d20d890e9a55f1447e7e5dcd.png) Following is my pattern. This 'AppCode' filed is defined under keyvalue named as %{GREEDYDATA: **nfckeyvalues** } %{EXIM\_DATE:NFC\_POS\_TIME}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{WORD}=%{INT:POS}%{NOTSPACE:RES}=%{INT},%{SPACE}%{GREEDYDATA:nfckeyvalues} sample log: 2017-10-18 00:14:10,861 [queueJobSchedulerPrivate\_Worker-23] INFO TICKET\_INFO - POS=80019642|RECIVED\_TO\_QUEUE|message=PRIVATE|LastTckSerialHeader=196420214628, ResponseBMCode=TX\_SUCCESS, LastTktRefNo=214561, TransactionType=6, TransactionSubType=0, PinReq=0, Pin=0, CvcReq=0, Cvc=0, **AppCode=505050** , CompanyId=1, SubAppId=0, Amount=10.0, PreBal=1483.5, PostBal=1473.5, StartLoc=1, EndLoc=2, PosTrnxTime=2017-10-17 18:15:54, IsNFC=1, TckSerial=196420214561, TckCountFull=1, TckCountHalf=0, TckCountLug=0, RouteDbId=956, TripDirection=1, TripId=3843, CardType=1, WayBillNo=0, Status=1, MerchantNo=00002495, ResponseTGCode=0, ResponseTGDesc=NO, ResponseCMSCode=8, ResponseCMSDesc=POS is not registered in the CMS, ResponseBMDesc=Duplicate Entry found, ResponseNBCode=0, ResponseNBDesc=null, TransactionID=36571948, MessageRecievedTime=2017-10-17 19:24:07, TimeDif=0, LastUpdateDate=2017-10-18 00:14:10, HeaderStatus=4, MessageSentTime=2017-10-18 00:14:08.0, EntCodeHeader=null, AppCodeHeader=505050, PosCodeHeader=80019642, PosTypeHeader=0, TnxTypeHeader=6, TxnNumHeader=null, IsNFCHeader=0, TxnTimeHeader=2017-10-17 19:23:56.0, RecCountHeader=35, FieldCountHeader=0, IsOnline=0, Did=7720171140, Uid=0469700A494380, ErrorCount=2, errCode=0, refCode=null ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 31, 2017, 7:21am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/2 "2017-10-31T07:21:50Z")
Is `AppCode` numeric or a string? See [Logstash filter not working. Probably my fault :D](https://discuss.elastic.co/t/logstash-filter-not-working-probably-my-fault-d/105811/2). ---
**Author:** ![ruranga](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@ruranga](https://discuss.elastic.co/u/ruranga)\ **Post date:** [October 31, 2017, 7:23am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/3 "2017-10-31T07:23:22Z")
It's a string ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 31, 2017, 10:07am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/4 "2017-10-31T10:07:17Z")
Really? Please show an example document. Copy/paste from Kibana's JSON tab. ---
**Author:** ![ruranga](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@ruranga](https://discuss.elastic.co/u/ruranga)\ **Post date:** [November 3, 2017, 5:21am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/5 "2017-11-03T05:21:26Z")
" AppCode": "505050", Extremely sorry for the delay ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 3, 2017, 6:21am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/6 "2017-11-03T06:21:57Z")
Okay, looks good. What does your complete configuration look like? Is the grok filter that extracts the `AppCode` field located prior to the conditional that doesn't appear to be firing? ---
**Author:** ![ruranga](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@ruranga](https://discuss.elastic.co/u/ruranga)\ **Post date:** [November 3, 2017, 8:01am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/7 "2017-11-03T08:01:45Z")
## Yes it's after the grok filter if [source] =~ "gateway\_tickets\_info\_" { if "MATCHED" not in [tags]{ grok { ``` patterns_dir => ["/apps/logstash-5.1.2/conf/patterns"] match => ["message", "%{NFC_POS}"] add_field => ["SYS", "nfc_pos"] add_tag => ["MATCHED"] remove_tag => ["_grokparsefailure"] } }else{ } } ``` #date for NFC POS date { match =\> ["NFC\_POS\_TIME" , "YYYY-MM-dd HH:mm:ss,SSS"] target =\> "NFC\_POS\_TIME" } kv { source =\> "nfcposkeyval" field\_split =\> "," } #NFC POS Tx type mapping if [AppCode] == "505050" { mutate {add\_field =\> ["NFC\_APP\_TYPE", "SEMA"]} }else if [AppCode] == "404040" { mutate {add\_field =\> ["NFC\_APP\_TYPE", "TRAVEL WP"]} }else{ } * * * grok pattern in /apps/logstash-5.1.2/conf/patterns NFC\_POS %{EXIM\_DATE:NFC\_POS\_TIME}%{SPACE}%{NOTSPACE}%{SPACE}INFO TICKET\_INFO - POS=%{INT:POS}|RECIVED\_TO\_QUEUE|message=PRIVATE|LastTckSerialHeader=%{INT:LastTckSerialHeader},%{SPACE}%{GREEDYDATA:nfcposkeyval} * * * Sample log 2017-10-18 00:12:31,870 [queueJobSchedulerPrivate\_Worker-20] INFO TICKET\_INFO - POS=80008999|RECIVED\_TO\_QUEUE|message=PRIVATE|LastTckSerialHeader=089990033718, ResponseBMCode=TX\_SUCCESS, LastTktRefNo=33685, TransactionType=6, TransactionSubType=0, PinReq=0, Pin=0, CvcReq=0, Cvc=0, AppCode=505050, CompanyId=1, SubAppId=0, Amount=20.0, PreBal=2176.5, PostBal=2156.5, StartLoc=8, EndLoc=4, PosTrnxTime=2016-12-08 06:29:08, IsNFC=1, TckSerial=089990033685, TckCountFull=1, TckCountHalf=0, TckCountLug=0, RouteDbId=EA, TripDirection=2, TripId=467, CardType=1, WayBillNo=0, Status=1, MerchantNo=00002256, ResponseTGCode=0, ResponseTGDesc=NO, ResponseCMSCode=8, ResponseCMSDesc=POS is not registered in the CMS, ResponseBMDesc=Duplicate Entry found, ResponseNBCode=0, ResponseNBDesc=null, TransactionID=11149510, MessageRecievedTime=2016-12-08 06:57:15, TimeDif=0, LastUpdateDate=2017-10-18 00:12:31, HeaderStatus=4, MessageSentTime=2017-10-18 00:11:51.0, EntCodeHeader=null, AppCodeHeader=505050, PosCodeHeader=80008999, PosTypeHeader=0, TnxTypeHeader=6, TxnNumHeader=null, IsNFCHeader=0, TxnTimeHeader=2016-12-08 06:57:04.0, RecCountHeader=36, FieldCountHeader=0, IsOnline=0, Did=7720214191, Uid=04853972974980, ErrorCount=1, errCode=0, refCode=null ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 3, 2017, 8:20am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/8 "2017-11-03T08:20:42Z")
> " AppCode": "505050", There's a leading space in the field name. ---
**Author:** ![ruranga](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@ruranga](https://discuss.elastic.co/u/ruranga)\ **Post date:** [November 3, 2017, 9:00am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/9 "2017-11-03T09:00:07Z")
Thank you very much for the prompt response!!! It's working now. Didn't see that space which appear due to split key values only with "," Thanks again! (Y) 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 1, 2017, 9:12am UTC](https://discuss.elastic.co/t/logstash-if-condition-issue/105843/10 "2017-12-01T09:12:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.