# Some trouble with if / else in logstash filter block

**URL:** <https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975>\
**Category:** Logstash\
**Created:** [May 2, 2016, 3:32pm UTC](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975 "2016-05-02T15:32:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kheraud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kheraud/32/9516_2.png) [@kheraud](https://discuss.elastic.co/u/kheraud)\
**Post date:** [May 2, 2016, 3:32pm UTC](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975/1 "2016-05-02T15:32:51Z")

</div>

Hello,  
First of all I discover ELK a bit late but I am very enthusiastic about these products.  
I am starting to play with it but I face a weird issue : impossible to do a simple `if / else` in my logstash `filter` block.  
I try to split grok filters between different log streams coming from docker containers. All my log events contains the `docker.image` field, I plan to use it for that.

`filter { if [docker.image] == "nginx:1.9" { mutate { add_field => { "matched" => "nginx" } } } else { mutate { add_field => { "matched" => "no" } } } }`

No matter how I do this `if`, all my logs have the field `matched` set to `no`. I tried with `if [docker.image]`, `if ["docker.image"]`, `if [docker\.image]`.

I bet this is something simple but I can't figure it out. Any hint ?

Best regards,

Karim

---

<div class="post-metadata">

**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\
**Post date:** [May 2, 2016, 5:06pm UTC](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975/2 "2016-05-02T17:06:07Z")

</div>

Try with : `if [docker][image]`

---

<div class="post-metadata">

**Author:** ![kheraud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kheraud/32/9516_2.png) [@kheraud](https://discuss.elastic.co/u/kheraud)\
**Post date:** [May 10, 2016, 7:29am UTC](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975/3 "2016-05-10T07:29:20Z")

</div>

You are right, `if [docker][image]` solved this

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975/4 "2017-07-06T04:58:23Z")

</div>