# Referring a multi level field in Logstash

**URL:** <https://discuss.elastic.co/t/referring-a-multi-level-field-in-logstash/311999>\
**Category:** Logstash\
**Created:** [August 12, 2022, 9:15am UTC](https://discuss.elastic.co/t/referring-a-multi-level-field-in-logstash/311999 "2022-08-12T09:15:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yuanchuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuanchuan/32/109581_2.png) [@yuanchuan](https://discuss.elastic.co/u/yuanchuan)\
**Post date:** [August 12, 2022, 9:15am UTC](https://discuss.elastic.co/t/referring-a-multi-level-field-in-logstash/311999/1 "2022-08-12T09:15:34Z")

</div>

Hi,

I would like to to do an output to a syslog when a fieldname with the name symantec\_endpoint.log.event\_description equals to "The....successfully"

The way that I refer the field in my code is not working, need help~!

```auto
output {
  if [symantec_endpoint][log][event_description] == "The management server received the client log successfully" {
      syslog {
        host => "196.60.0.22"
        port => 514
        rfc => ["rfc5424"]
        protocol => ["tcp"]
        appname => "Elastic Stack"
        message => "messssssagesssss"
        facility => "appnameeee"
        codec => "plain"
        priority => "priorityyyyy"
        severity => "serverityyyyy"
        sourcehost => "sourcehosttttt"
        reconnect_interval => "60"
        enable_metric => false
        procid => "procidddddd"
      }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 12, 2022, 9:36am UTC](https://discuss.elastic.co/t/referring-a-multi-level-field-in-logstash/311999/2 "2022-08-12T09:36:49Z")

</div>

Please show a sample event that you would expect to match the criteria.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2022, 9:36am UTC](https://discuss.elastic.co/t/referring-a-multi-level-field-in-logstash/311999/3 "2022-09-09T09:36:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.