# \[solved\] Logstash if condition sometimes not work!

**URL:** <https://discuss.elastic.co/t/solved-logstash-if-condition-sometimes-not-work/164733>\
**Category:** Logstash\
**Created:** [January 18, 2019, 5:19am UTC](https://discuss.elastic.co/t/solved-logstash-if-condition-sometimes-not-work/164733 "2019-01-18T05:19:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nils.xia](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@nils.xia](https://discuss.elastic.co/u/nils.xia)\
**Post date:** [January 18, 2019, 5:19am UTC](https://discuss.elastic.co/t/solved-logstash-if-condition-sometimes-not-work/164733/1 "2019-01-18T05:19:02Z")

</div>

Here is my logstash's config:  
input {  
beats {  
port =\> 8888  
}  
}  
output {  
if [message] =~ "[ERROR]" {  
exec {  
command =\> "echo -e %{fields} 上出现以下日志报警: '\n\n' %{message} '\n\n' 请登录 [http://172.17.96.165:5601](http://172.17.96.165:5601) 查看日志 | mail -s 生产环境日志报警 [xxx@xxx.com](mailto:xxx@xxx.com)"  
}  
}  
elasticsearch {  
hosts =\> "172.17.96.165:9200"  
index =\> "karpfi-log-nodejs"  
}  
}

I found some logs the if condition was not match，such as:  
2019-01-18 03:24:05.702 [ERROR] [console] [cess/warning.js:18] (node:14) [DEP0022] DeprecationWarning: os.tmpDir() is deprecated. Use os.tmpdir() instead.

And some logs the if condition was match，such as:  
06:29:57.733 [INFO] [ERROR] [api/services/utils.js:66] {data:{},error:null,success:true}

---

<div class="post-metadata">

**Author:** ![nils.xia](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@nils.xia](https://discuss.elastic.co/u/nils.xia)\
**Post date:** [January 18, 2019, 5:43am UTC](https://discuss.elastic.co/t/solved-logstash-if-condition-sometimes-not-work/164733/2 "2019-01-18T05:43:01Z")

</div>

Sorry,It's my fault.The problem is the commad.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2019, 5:43am UTC](https://discuss.elastic.co/t/solved-logstash-if-condition-sometimes-not-work/164733/3 "2019-02-15T05:43:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.