# Logstash "if statement" not working for logs from winlogbeat 7.13.2 (works on older version)
**URL:** https://discuss.elastic.co/t/logstash-if-statement-not-working-for-logs-from-winlogbeat-7-13-2-works-on-older-version/281179
**Category:** Logstash
**Created:** [August 12, 2021, 9:57am UTC](https://discuss.elastic.co/t/logstash-if-statement-not-working-for-logs-from-winlogbeat-7-13-2-works-on-older-version/281179 "2021-08-12T09:57:05Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@heikis](https://discuss.elastic.co/u/heikis)
#### Post date: [August 12, 2021, 9:57am UTC](https://discuss.elastic.co/t/logstash-if-statement-not-working-for-logs-from-winlogbeat-7-13-2-works-on-older-version/281179/1 "2021-08-12T09:57:05Z")
Hello. I have a weird problem with Logstash filtering.
I am sending logs from several different winlogbeat agents to logstash for processing.
I have winlogbeats agents with different versions- 7.9.1 and 7.13.2.
Logstash is on version 7.13.2.
The problem is that Logstash does not match (and therefore does not add tag) the "if condition" for logs from agent 7.13.2 but matches (and tags) logs from 7.9.1. Why?
Both winlogbeat 7.13.2 and 7.9.1 events are indexed in elasticsearch- just that 7.9.1 has been tagged and 7.13.2 has not been tagged. Mutations without the "if condition" are working on both versions.
Both winlogbeat agents are sending logs to logstash with `event.code` present. And logstash sends the `event.code` as strings to elasticsearch and elasticsearch indexes `event.code` from both versions as strings. Kibana search also finds indexed documents with `event.code == 9999` from both winlogbeat versions. But one document has tag added, other does not.
The (redacted) filter I am using:
```auto
filter {
if [event][code] == 9999 {
mutate {add_tag => ["tagged"] }
}
}
```
Any ideas/suggestions? Thank you!
_-update-_
I just figured out that logs from winlogbeat 7.9.1 are matched: `if [event][code] == 9999`
and logs from winlogbeat 7.13.2 are matched: `if [event][code] == "9999"`
_-update2-_
**Problem solved**.
Release notes for Winlogbeat 7.13.0 [Beats version 7.13.0 | Beats Platform Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-7.13.0.html) :
> - Change `event.code` and `winlog.event_id` from int to keyword. [25176](https://github.com/elastic/beats/pull/25176)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 9, 2021, 9:57am UTC](https://discuss.elastic.co/t/logstash-if-statement-not-working-for-logs-from-winlogbeat-7-13-2-works-on-older-version/281179/2 "2021-09-09T09:57:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.