# Make logstash filter by name

**URL:** <https://discuss.elastic.co/t/make-logstash-filter-by-name/241526>\
**Category:** Logstash\
**Created:** [July 16, 2020, 6:24pm UTC](https://discuss.elastic.co/t/make-logstash-filter-by-name/241526 "2020-07-16T18:24:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\
**Post date:** [July 16, 2020, 6:24pm UTC](https://discuss.elastic.co/t/make-logstash-filter-by-name/241526/1 "2020-07-16T18:24:16Z")

</div>

I have a log file called "/var/log/commands.log" that I'm trying to separate into fields with logstash & grok. I've got it working. Now, I'm trying to make logstash only do this to the file "/var/log/commands.log" and not any input by doing "if name = commands.log" but something with the "if" statement seems wrong as it skips over it.

```
    input{
    file{
    path => "/var/log/commands.log"
    }
    beats{
    port => 5044
    }
    }
    filter {
    if [log][file][path] == "/var/log/commands.log" {
    grok{
    match => { "message" => "*very long statement*"
    }
    }
    }
    }
    output{
    elasticsearch { hosts => ["localhost:9200"]}
    }

```

If I remove the if statement it works and the fields are visible in kibana. I'm testing things locally. Does anyone know what's going on?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2020, 6:49pm UTC](https://discuss.elastic.co/t/make-logstash-filter-by-name/241526/2 "2020-07-16T18:49:30Z")

</div>

> [@elk6](#):
>
> `if [log][file][path] ==`

I think beats set [log][file][path], but a file input just sets [path]

---

<div class="post-metadata">

**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\
**Post date:** [July 16, 2020, 8:30pm UTC](https://discuss.elastic.co/t/make-logstash-filter-by-name/241526/3 "2020-07-16T20:30:14Z")

</div>

Thank you SO MUCH! I have a follow up question if that's allowed, I'm also trying to make it read JSON logs. On another machine, I've got it working by adding the following to filebeat:

```
processors:
  - decode_json_fields:
      fields: ["message"]
      process_array: false
      max_depth: 1
      target: ""
      overwrite_keys: false
      add_error_key: true

```

Is it possible to achieve in logstash?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2020, 9:49pm UTC](https://discuss.elastic.co/t/make-logstash-filter-by-name/241526/4 "2020-07-16T21:49:59Z")

</div>

There is a [json](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) filter that can parse json.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2020, 9:50pm UTC](https://discuss.elastic.co/t/make-logstash-filter-by-name/241526/5 "2020-08-13T21:50:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.