# Merticbeat isn't working with if else condition
**URL:** https://discuss.elastic.co/t/merticbeat-isnt-working-with-if-else-condition/165734
**Category:** Beats
**Tags:** metricbeat
**Created:** [January 25, 2019, 9:29am UTC](https://discuss.elastic.co/t/merticbeat-isnt-working-with-if-else-condition/165734 "2019-01-25T09:29:55Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Vinit\_Kumar](https://discuss.elastic.co/u/Vinit_Kumar)
#### Post date: [January 25, 2019, 9:29am UTC](https://discuss.elastic.co/t/merticbeat-isnt-working-with-if-else-condition/165734/1 "2019-01-25T09:29:55Z")
I'm using Filebeat to collect custom logs and Metricbeat to monitor system (CPU, RAM, DISK SPACE). I'm able to do this without using if condition and if I'm using if conduction in the logstash filter then it is not working at all.
Below is my logstash beat-conf.conf file
```
input {
beats {
port => 5044
}
}
filter {
if [log_type] == "apache" {
grok {
match => { "message" => "^%{IP:CLIENT_IP} (?:-|%{USER:IDEN}) (?:-|%{USER:AUTH}) \[%{HTTPDATE:CREATED_ON}\] \"(?:%{WORD:REQUEST_METHOD} (?:/|%{NOTSPACE:REQUEST})(?: HTTP/%{NUMBER:HTTP_VERSION})?|-)\" %{NUMBER:RESPONSE_CODE}%{SPACE} (?:-|%{NOTSPACE:BYTE})%{SPACE}(?:-|%{NOTSPACE:EXECUTION_TIME})"}
add_field => {
"LOG_TYPES" => "apache-log"
}
overwrite => ["message"]
}
}
}
output {
if "apache" in [log_type] or [_type] in ["metricsets","metricbeat"] {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "metricbeat-index"
}
stdout { codec => rubydebug }
}
}
```
I want to use if conduction because in local I have only a limited source of the log. But in production, I have 4 machines and every machine is having different log pattern to another machine.
---
### Author:  [@Vinit\_Kumar](https://discuss.elastic.co/u/Vinit_Kumar)
#### Post date: [January 25, 2019, 11:51am UTC](https://discuss.elastic.co/t/merticbeat-isnt-working-with-if-else-condition/165734/2 "2019-01-25T11:51:20Z")
I changed the if conduction so It's working now
```
input {
beats {
port => 5044
}
}
filter {
if [log_type] == "apache" {
grok {
match => { "message" => "^%{IP:CLIENT_IP} (?:-|%{USER:IDEN}) (?:-|%{USER:AUTH}) \[%{HTTPDATE:CREATED_ON}\] \"(?:%{WORD:REQUEST_METHOD} (?:/|%{NOTSPACE:REQUEST})(?: HTTP/%{NUMBER:HTTP_VERSION})?|-)\" %{NUMBER:RESPONSE_CODE}%{SPACE} (?:-|%{NOTSPACE:BYTE})%{SPACE}(?:-|%{NOTSPACE:EXECUTION_TIME})"}
add_field => {
"LOG_TYPES" => "apache-log"
}
overwrite => ["message"]
}
}
}
output {
if "metricbeat" in [@metadata][beat] or "apache" in [log_type] {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "metricbeat-in"
}
stdout { codec => rubydebug }
}
}
```
---
### Author:  [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [February 4, 2019, 1:03pm UTC](https://discuss.elastic.co/t/merticbeat-isnt-working-with-if-else-condition/165734/3 "2019-02-04T13:03:33Z")
Hi @Vinit_Kumar 🙂
I'm confused, is it a logstash issue or metricbeat? Can you mark it as solved if it's working already?
---
### Author:  [@Vinit\_Kumar](https://discuss.elastic.co/u/Vinit_Kumar)
#### Post date: [February 4, 2019, 1:09pm UTC](https://discuss.elastic.co/t/merticbeat-isnt-working-with-if-else-condition/165734/4 "2019-02-04T13:09:20Z")
It was the logstash issue.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 4, 2019, 1:15pm UTC](https://discuss.elastic.co/t/merticbeat-isnt-working-with-if-else-condition/165734/5 "2019-03-04T13:15:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.