# Processor in cascade
**URL:** https://discuss.elastic.co/t/processor-in-cascade/210971
**Category:** Beats
**Tags:** winlogbeat
**Created:** [December 7, 2019, 3:11pm UTC](https://discuss.elastic.co/t/processor-in-cascade/210971 "2019-12-07T15:11:38Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@franco.federico](https://discuss.elastic.co/u/franco.federico)
#### Post date: [December 7, 2019, 3:11pm UTC](https://discuss.elastic.co/t/processor-in-cascade/210971/1 "2019-12-07T15:11:38Z")
Hi all
I think to use `processor`, I'd like to know if it possible to do this
```
processors:
- add_filed:
fields:
name: "pippo","pluto","paperino"
processors:
- if:
contains:
name: "pluto"
then:
- add_tags
tags: true
target: "is_found"
else:
- drop_event
```
Do you think that is a correct configuration? I'd like to improve this processor in cascade with `if contains` change contains with another condition in order to check a field in winlogbeat like this
```
- if:
contains:
name: winlog.eventdata.user
```
Thank you
Franco
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 3, 2020, 3:36am UTC](https://discuss.elastic.co/t/processor-in-cascade/210971/2 "2020-01-03T03:36:33Z")
Aside from some indentation issues, yes, you can nest `if` statements. If your logic is getting to complicated to be represented in YAML you could also try the [script processor](https://www.elastic.co/guide/en/beats/winlogbeat/master/processor-script.html).
```auto
processors:
- script:
lang: javascript
id: my_filter
source: >
function process(event) {
var name = event.Get("name");
if (name === "pluto") {
event.Tag("is_found");
} else {
event.Cancel();
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 31, 2020, 3:36am UTC](https://discuss.elastic.co/t/processor-in-cascade/210971/3 "2020-01-31T03:36:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.