# Need to use a if condition

**URL:** <https://discuss.elastic.co/t/need-to-use-a-if-condition/71445>\
**Category:** Logstash\
**Created:** [January 12, 2017, 10:36pm UTC](https://discuss.elastic.co/t/need-to-use-a-if-condition/71445 "2017-01-12T22:36:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lahiru\_Lakshitha\_Sam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lahiru_lakshitha_sam/32/14521_2.png) [@Lahiru\_Lakshitha\_Sam](https://discuss.elastic.co/u/Lahiru_Lakshitha_Sam)\
**Post date:** [January 12, 2017, 10:36pm UTC](https://discuss.elastic.co/t/need-to-use-a-if-condition/71445/1 "2017-01-12T22:36:52Z")

</div>

Hi I need to use a if condition in my application for example  
"monitoredCIName" =\> "icdudautmutl23" if monitoredCINme is start with "icd" I need to add new field  
how do I do that???

OS: CentOs  
logstash Version 5.1.1  
Example output:

"description" =\> "TEST - Metric Memory Usage = 18%",  
"type" =\> "vdash\_events",  
"title" =\> "TEST - [icdudautmutl23.pearsontc.com](http://icdudautmutl23.pearsontc.com)",  
"raisedTimestamp" =\> "2017-01-12T22:33:05+0000",  
"host" =\> "10.25.7.242",  
"date\_raised" =\> "2017-01-12",  
"trigger" =\> "TEST - [icdudautmutl23.pearsontc.com](http://icdudautmutl23.pearsontc.com)",  
"tags" =\> [],  
"@timestamp" =\> 2017-01-12T22:33:48.618Z,  
"monitoredCIName" =\> "icdudautmutl23",  
"category" =\> "Host"

I'm new to ELK BTW

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 17, 2017, 8:49pm UTC](https://discuss.elastic.co/t/need-to-use-a-if-condition/71445/2 "2017-01-17T20:49:19Z")

</div>

```nohighlight
if [monitoredCINme] =~ /^icd/ {
  mutate {
    add_field => {
      "field name" => "field value"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2017, 8:49pm UTC](https://discuss.elastic.co/t/need-to-use-a-if-condition/71445/3 "2017-02-14T20:49:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.