# Not in tags condition
**URL:** https://discuss.elastic.co/t/not-in-tags-condition/143885
**Category:** Logstash
**Created:** [August 10, 2018, 3:03pm UTC](https://discuss.elastic.co/t/not-in-tags-condition/143885 "2018-08-10T15:03:59Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@chandra0651](https://discuss.elastic.co/u/chandra0651)
#### Post date: [August 10, 2018, 3:03pm UTC](https://discuss.elastic.co/t/not-in-tags-condition/143885/1 "2018-08-10T15:03:59Z")
Hello I am trying to ingest into Elasticsearch if the documents dont have couple of tags, but some how still the documents are getting persisted if the tags present. below is my code .The tags with "\_split\_type\_failure" are still getting ingested into ES.
> output {
> if "\_xmlparsefailure" not in [tags] or "\_split\_type\_failure" not in [tags] {
> elasticsearch {
> hosts =\>
> index =\>""
> }
> }
> }
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 10, 2018, 4:05pm UTC](https://discuss.elastic.co/t/not-in-tags-condition/143885/2 "2018-08-10T16:05:02Z")
Do you get what you want if you replace or with || ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2018, 4:53pm UTC](https://discuss.elastic.co/t/not-in-tags-condition/143885/3 "2018-08-10T16:53:17Z")
> Do you get what you want if you replace or with || ?
I'd expect a syntax error. `or` is the correct operator for logical OR.
> **[Accessing event data and fields | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)**
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2018, 4:54pm UTC](https://discuss.elastic.co/t/not-in-tags-condition/143885/4 "2018-08-10T16:54:41Z")
You should probably use `and` instead of `or`. As it stands, an event with a `_split_type_failure` tag will be indexed _unless_ it _also_ has an `_xmlparsefailure` tag.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2018, 4:54pm UTC](https://discuss.elastic.co/t/not-in-tags-condition/143885/5 "2018-09-07T16:54:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.