# Logstash IF Statement

**URL:** <https://discuss.elastic.co/t/logstash-if-statement/167869>\
**Category:** Logstash\
**Created:** [February 11, 2019, 2:00pm UTC](https://discuss.elastic.co/t/logstash-if-statement/167869 "2019-02-11T14:00:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![luiz.miguelsl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luiz.miguelsl/32/66382_2.png) [@luiz.miguelsl](https://discuss.elastic.co/u/luiz.miguelsl)\
**Post date:** [February 11, 2019, 2:00pm UTC](https://discuss.elastic.co/t/logstash-if-statement/167869/1 "2019-02-11T14:00:33Z")

</div>

What's up everyone?! I wish you're all doing great.

Take a look at this problem I'm facing. I'm loading a few log files from an Apache to ELK via Logstash. The process is pretty simple, I use the input to read the file and an output to send data to ElasticSearch. As I have more than one VirtualHost on my Apache, I have 3, sometimes 4 or more log files I need to send. I generate individual indexes on ElasticSearch for each VirtualHost I have, and it's been working pretty well so far. I got a problem now that I have two VirtualHosts pretty like each other, and it seems that the LogStash isn't being able to differ that. My config:

Logstash.conf file:

```
  input {
        file {
            path => ["/path/apache/logs/soasa3.intranet_access*","/path/apache/logs/soasa.intranet_access*"]
            start_position => beginning
            exclude => "*.gz"
        }
    }

output {

        if [path] =~ "soasa"{
                elasticsearch { hosts => ["myserver:9200"]
                index => "soasalogsacess-%{+yyyy.MM.dd}"
                }

                stdout {
                codec => rubydebug
                }
        }
      
        else [path] =~ "soasa3" {
                elasticsearch { hosts => ["myserver:9200"]
                index => "soasa3logsacess-%{+yyyy.MM.dd}"
                }

                stdout {
                codec => rubydebug
                }
        }

```

As you can see, my VirtualHosts are soasa3.intranet and soasa.intranet.

With the configuration I mentioned, all data are in my index called soasalogsacess. If I Invert the order of the config file, like my first if statement is soasa3 and the second one soasa , It works fine. Is there any precedence order, like the more complex one, should come first??

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 11, 2019, 2:07pm UTC](https://discuss.elastic.co/t/logstash-if-statement/167869/2 "2019-02-11T14:07:14Z")

</div>

As you are using regular expressions you will need to switch the order as everything will be caught by the first pattern as it is less specific.

---

<div class="post-metadata">

**Author:** ![luiz.miguelsl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luiz.miguelsl/32/66382_2.png) [@luiz.miguelsl](https://discuss.elastic.co/u/luiz.miguelsl)\
**Post date:** [February 11, 2019, 2:10pm UTC](https://discuss.elastic.co/t/logstash-if-statement/167869/3 "2019-02-11T14:10:03Z")

</div>

I edited the question, pressed the save without finishing it heheh

But I think you answered my question. As I'm using regular expressions, the more specific one should come first, right?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2019, 2:10pm UTC](https://discuss.elastic.co/t/logstash-if-statement/167869/4 "2019-03-11T14:10:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.