# Or condition doesn't work

**URL:** <https://discuss.elastic.co/t/or-condition-doesnt-work/133831>\
**Category:** Logstash\
**Created:** [May 30, 2018, 9:07am UTC](https://discuss.elastic.co/t/or-condition-doesnt-work/133831 "2018-05-30T09:07:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\
**Post date:** [May 30, 2018, 9:07am UTC](https://discuss.elastic.co/t/or-condition-doesnt-work/133831/1 "2018-05-30T09:07:01Z")

</div>

Hello everybody,

I use logstash to parse these messages :

**28/05/2018 16:01:06.716 (SERVICE) 29/05/2018/D T UE\_TECXXX\_J\_TN\_SSH005\_LOG\_PGAH8\_SIGN(21863)/UE\_TECXXX\_X\_LL\_OPE003\_TECHNIQUE PLA STATUS : PL Toutes les contraintes de planification de la localisation UE\_TECXXX\_X\_LL\_OPE003\_TECHNIQUE de la tâche UE\_TECXXX\_J\_TN\_SSH005\_LOG\_PGAH8\_SIGN sont réalisées**  
28/05/2018 16:02:34.076 (TACHE) 28/05/2018/D T OR\_WKFXXX\_J\_TN\_WKF997\_PUB\_TELE\_OP(15519)/OR\_XXXXXX\_X\_LL\_POC001\_PROTOPROD EXE STATUS : EX Ecriture d'un message de lancement de la procédure XX\_XXXXXX\_X\_XX\_DCK003\_BATCH\_LOCAL (AGENT) (REF=71858948,LAPSE=0) : LANPRO,TCH=15519,PROC=1932,VPROC=961000,DATE=20180528,MEX=P,TYPE=S,VEPROC=74339,EPROC=4,DHPROC=28052018160234,NOM=XX\_XXXXXX\_X\_XX\_DCK003\_BATCH\_LOCAL,VAR=O,NB=16,LOG=O  
28/05/2018 16:02:35.510 (SERVICE) 28/05/2018/D V XX\_XXXXXX\_X\_VA\_XXX000\_DATSYS(0)/ MSG STATUS : SL Début du traitement de l'action PVARTS venant du serveur _LOCAL_  
28/05/2018 16:02:35.526 (SERVICE) 28/05/2018/D T OR\_WKFXXX\_J\_TN\_WKF997\_PUB\_TELE\_OP(15519)/OR\_XXXXXX\_X\_LL\_POC001\_PROTOPROD TAC STATUS : MV Modification de la variable XX\_XXXXXX\_X\_VA\_XXX000\_DATSYS : nouvelle valeur : 20180528-20180528-1602.log (N° 1)  
28/05/2018 16:02:35.526 (SERVICE) 28/05/2018/D V XX\_XXXXXX\_X\_VA\_XXX000\_DATSYS(40)/DEFAUT MSG STATUS : SL Fin du traitement de l'action PVARTS venant du serveur _LOCAL_  
28/05/2018 16:02:43.186 (EXTERNE) 28/05/2018/D T OR\_WKFXXX\_J\_TN\_WKF997\_PUB\_TELE\_OP(15519)/OR\_XXXXXX\_X\_LL\_POC001\_PROTOPROD DEB STATUS : EC La tâche est en exécution sur l'agent XX\_XXXXXX\_X\_AG\_LIN001\_LRDOCORSEDT1 (2126) : LANPRO N° 71858948, ATTENTE DE 9 seconde(s)  
28/05/2018 16:03:01.100 (EXTERNE) 28/05/2018/D T OR\_WKFXXX\_J\_TN\_WKF997\_PUB\_TELE\_OP(15519)/OR\_XXXXXX\_X\_LL\_POC001\_PROTOPROD FIN STATUS : EC La tâche se termine : réception d'une fin de procédure (STS=OK,EXIT=0,MSG=ARRET\_NORMAL\_PAR\_EXIT(000),LAPSE=21,CP=1,IO=8,LOG=O,TRF=N)  
**28/05/2018 16:03:04.156 (TACHE) 28/05/2018/D T OR\_WKFXXX\_J\_TN\_WKF997\_PUB\_TELE\_OP(15519)/OR\_XXXXXX\_X\_LL\_POC001\_PROTOPROD TER STATUS : TN Terminaison normale de la tâche (TN EXIT CODE 0)**  
28/05/2018 16:03:04.203 (TACHE) 28/05/2018/D T OR\_WKFXXX\_J\_TN\_WKF998MT\_CALC\_STAT\_JOUR(15805)/OR\_XXXXXX\_X\_LL\_POC001\_PROTOPROD EXP STATUS : AC Mise en attente de prédécesseur de la tâche : 1

I would like to drop any sentences that do not contain "CODE" or "réalisées"

I can have only "non CODE" sentences with :

```
if [message] !~ "CODE"
  {
    drop { }
  }

```

I can also have only "non réalisées" sentences with :

```
if [message] !~ "réalisées"
  {
    drop { }
  }

```

But when I want to merge these two conditions with :

```
if [message] !~ "réalisées" or [message] !~ "CODE"
  {
    drop { }
  }

```

It doesn't work and logstash drop every messages

That's why I think my IF condition is false but I can't understand why

Can somebody help me ?

Thx for all

---

<div class="post-metadata">

**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\
**Post date:** [May 30, 2018, 9:10am UTC](https://discuss.elastic.co/t/or-condition-doesnt-work/133831/2 "2018-05-30T09:10:30Z")

</div>

I found my mistake, I replace "or" by "and", and now it works..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2018, 9:10am UTC](https://discuss.elastic.co/t/or-condition-doesnt-work/133831/3 "2018-06-27T09:10:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.