# True/false value form filebeat is ignored in logstash

**URL:** <https://discuss.elastic.co/t/true-false-value-form-filebeat-is-ignored-in-logstash/174833>\
**Category:** Logstash\
**Created:** [April 1, 2019, 6:02pm UTC](https://discuss.elastic.co/t/true-false-value-form-filebeat-is-ignored-in-logstash/174833 "2019-04-01T18:02:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![roblopes](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@roblopes](https://discuss.elastic.co/u/roblopes)\
**Post date:** [April 1, 2019, 6:02pm UTC](https://discuss.elastic.co/t/true-false-value-form-filebeat-is-ignored-in-logstash/174833/1 "2019-04-01T18:02:52Z")

</div>

Hi,

I have a filebeat parameter called "keep\_message", where the value should be true or false. In filebeat, it is configured like that:

```auto
  paths:
    - c:\temp\ssis.txt
  
  fields_under_root: true
  fields:
    keep_message: true

```

The purpose of this parameter is to delete or not the original message from the document, however doesn't matter what value I put there (true or false), the message is deleted and based on the tags, it always falls into the true condition.  
The default value should be false. Here is how I configured logstash:

```auto
	mutate { add_tag => ["debug_tag_before_keep_message_1"] }
	if !("true" in [keep_message]) {
		mutate { add_tag => ["debug_tag_inside_if_keep_message_2"] }
		mutate {
			remove_field => ["message"]
		}
	}
	else {
		mutate { add_tag => ["debug_tag_inside_else_keep_message_3"] }
	}

```

However, when I run the process, the message is always removed, and I get the following tags:

```auto
        [0] "debug_tag_before_keep_message_17",
        [1] "debug_tag_inside_if_keep_message_18"

```

I tried different condition combinations, but none of them worked, like:

```auto
	if !('true' in [keep_message]) {
	if ([keep_message] != 'true') {
	if ([keep_message] != "true") {

```

Also, I can see that the proper value is properly sent to logstash:

```auto
        "keep_message" => true

```

Any idea on what could be wrong? Any help will be more then welcome and appreciated.

Thanks,  
Rob

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2019, 6:19pm UTC](https://discuss.elastic.co/t/true-false-value-form-filebeat-is-ignored-in-logstash/174833/2 "2019-04-01T18:19:04Z")

</div>

> [@roblopes](#):
>
> "keep\_message" =\> true

keep\_message is a boolean, not a string (there are no quotes around it). Try

```
if ! [keep_message] ...

```

---

<div class="post-metadata">

**Author:** ![roblopes](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@roblopes](https://discuss.elastic.co/u/roblopes)\
**Post date:** [April 1, 2019, 6:24pm UTC](https://discuss.elastic.co/t/true-false-value-form-filebeat-is-ignored-in-logstash/174833/3 "2019-04-01T18:24:14Z")

</div>

Hey @Badger, you nailed it (again!).

Thanks a lot. Really appreciate.

Rob.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2019, 6:24pm UTC](https://discuss.elastic.co/t/true-false-value-form-filebeat-is-ignored-in-logstash/174833/4 "2019-04-29T18:24:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.