# Logstash output condition to filter a string in syslog

**URL:** <https://discuss.elastic.co/t/logstash-output-condition-to-filter-a-string-in-syslog/237024>\
**Category:** Logstash\
**Created:** [June 14, 2020, 11:49am UTC](https://discuss.elastic.co/t/logstash-output-condition-to-filter-a-string-in-syslog/237024 "2020-06-14T11:49:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sanjedi](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@sanjedi](https://discuss.elastic.co/u/sanjedi)\
**Post date:** [June 14, 2020, 11:49am UTC](https://discuss.elastic.co/t/logstash-output-condition-to-filter-a-string-in-syslog/237024/1 "2020-06-14T11:49:37Z")

</div>

Hi,

I am new to ELK and trying to send syslogs based on a customer code to different ES indexes using Logstash.  
I am trying following with no luck.

input {  
udp {  
type =\> syslogs  
port =\> 5001  
}  
}  
output {

```
  if [message] in "ABC"{
      elasticsearch {
            hosts => ["http://elasticsearch:9200"]
            index => "abc_index_%{+YYYY.MM.dd}"
    }

```

}  
}

Please kindly advice on the correct way of coding this in Logstash config pipe.

Cheers

---

<div class="post-metadata">

**Author:** ![sanjedi](https://avatars.discourse-cdn.com/v4/letter/s/bcef8e/32.png) [@sanjedi](https://discuss.elastic.co/u/sanjedi)\
**Post date:** [June 14, 2020, 12:50pm UTC](https://discuss.elastic.co/t/logstash-output-condition-to-filter-a-string-in-syslog/237024/2 "2020-06-14T12:50:37Z")

</div>

Actually I used "=~" instated of "in" and it worked.  
Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2020, 12:50pm UTC](https://discuss.elastic.co/t/logstash-output-condition-to-filter-a-string-in-syslog/237024/3 "2020-07-12T12:50:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.