# OR condition in Logstash is not working

**URL:** <https://discuss.elastic.co/t/or-condition-in-logstash-is-not-working/186406>\
**Category:** Logstash\
**Created:** [June 19, 2019, 8:02am UTC](https://discuss.elastic.co/t/or-condition-in-logstash-is-not-working/186406 "2019-06-19T08:02:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arpit\_Gulati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arpit_gulati/32/48349_2.png) [@Arpit\_Gulati](https://discuss.elastic.co/u/Arpit_Gulati)\
**Post date:** [June 19, 2019, 8:02am UTC](https://discuss.elastic.co/t/or-condition-in-logstash-is-not-working/186406/1 "2019-06-19T08:02:17Z")

</div>

Hi,  
I need to drop some events in logtstash and for this I write a if condition if ( [externalId] != "4663" and "4662" not in [externalId] and "4728" not │le Management in [externalId] and "4769" not in [externalId] and "4698" not in [externalId] and │[2019-06-19T07:54:22,334][INFO][logstash.outputs.elasticsearch] Attempting to inst "4672" not in [externalId] and "4625" not in [externalId] and "4624" not in [exte│all template {:manage\_template=\>{"index\_patterns"=\>["kotakbank-ad-_"], "settings"=\>rnalId] and "4907" not in [externalId] and "4764" not in [externalId] and "4755" │{"index"=\>{"codec"=\>"best\_compression", "refresh\_interval"=\>"5s", "number\_of\_shardsnot in [externalId] and "4754" not in [externalId] and "4739" not in [externalId] │"=\>"3", "number\_of\_replicas"=\>"0"}}, "mappings"=\>{"doc"=\>{"dynamic\_templates"=\>[{"mand "4735" not in [externalId] and "4727" not in [externalId] and "4724" not in [│essage\_field"=\>{"path\_match"=\>"b\_evt\_raw\_msg", "match\_mapping\_type"=\>"string", "mapexternalId] and "4716" not in [externalId] and "4706" not in [externalId] and "47│ping"=\>{"norms"=\>false, "type"=\>"text"}}}, {"string\_fields"=\>{"match"=\>"_", "match\_94" not in [externalId] and "4765" not in [externalId] and "4719" not in [external│mapping\_type"=\>"string", "mapping"=\>{"fields"=\>{"keyword"=\>{"ignore\_above"=\>256, "tId]) { drop { } }

but in this case all the events having externalId are drop. I think the OR condition is not working. I am using logstash version 7.1.

Please Help !!!!

---

<div class="post-metadata">

**Author:** ![Arpit\_Gulati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arpit_gulati/32/48349_2.png) [@Arpit\_Gulati](https://discuss.elastic.co/u/Arpit_Gulati)\
**Post date:** [June 19, 2019, 8:28am UTC](https://discuss.elastic.co/t/or-condition-in-logstash-is-not-working/186406/2 "2019-06-19T08:28:33Z")

</div>

sorry replace and with or.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 19, 2019, 1:09pm UTC](https://discuss.elastic.co/t/or-condition-in-logstash-is-not-working/186406/3 "2019-06-19T13:09:28Z")

</div>

Your post is unreadable. Please edit your post, select the actual configuration and click on \</\> in the toolbar above the edit pane, then verify that the configuration is shown correctly in the preview pane on the right.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2019, 9:09am UTC](https://discuss.elastic.co/t/or-condition-in-logstash-is-not-working/186406/5 "2019-07-24T09:09:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.