# Processor conditions: default case?

**URL:** <https://discuss.elastic.co/t/processor-conditions-default-case/96093>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 7, 2017, 11:49am UTC](https://discuss.elastic.co/t/processor-conditions-default-case/96093 "2017-08-07T11:49:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mguiwin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mguiwin/32/6743_2.png) [@mguiwin](https://discuss.elastic.co/u/mguiwin)\
**Post date:** [August 7, 2017, 11:49am UTC](https://discuss.elastic.co/t/processor-conditions-default-case/96093/1 "2017-08-07T11:49:32Z")

</div>

Hi,

Is there any efficient way to tell FB that if one or multiple conditions are met and corresponding data is processed by corresponding processor(s), _everything else_ goes to another - default - processor?

Example of my current configuration:

```
output.elasticsearch:
[...]
  pipelines:
  - pipeline: "logs-with-error"
    when.regexp:
      message: '^20[0-9]{2}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3} ERROR \('
  - pipeline: "logs-without-error"
    not.regexp:
      message: '^20[0-9]{2}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3} ERROR \('

```

As you can see, I have to declare a `not.regexp` condition here just to handle the non-matching, default case. That means that the same regexp is executed twice, which is not optimal in termes of performance / ressource usage.

Is there any better way?

Thanks,  
MG

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [August 7, 2017, 2:47pm UTC](https://discuss.elastic.co/t/processor-conditions-default-case/96093/2 "2017-08-07T14:47:48Z")

</div>

The `pipeline` setting will be default case, if no other cases match. Plus, the matching returns on first matching condition.

for example:

```auto
output.elasticsearch:
  pipeline: "logs-without-error"
  pipelines:
  - pipeline: "logs-with-error"
    when.regexp.message: ...

```

---

<div class="post-metadata">

**Author:** ![mguiwin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mguiwin/32/6743_2.png) [@mguiwin](https://discuss.elastic.co/u/mguiwin)\
**Post date:** [August 7, 2017, 5:02pm UTC](https://discuss.elastic.co/t/processor-conditions-default-case/96093/3 "2017-08-07T17:02:51Z")

</div>

Thanks, that works!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2017, 5:02pm UTC](https://discuss.elastic.co/t/processor-conditions-default-case/96093/4 "2017-09-04T17:02:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.