# Unable to set sub-condition in condition

**URL:** <https://discuss.elastic.co/t/unable-to-set-sub-condition-in-condition/169400>\
**Category:** Logstash\
**Created:** [February 21, 2019, 11:31am UTC](https://discuss.elastic.co/t/unable-to-set-sub-condition-in-condition/169400 "2019-02-21T11:31:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rudolf\_Reddy\_Macejka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rudolf_reddy_macejka/32/12875_2.png) [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)\
**Post date:** [February 21, 2019, 11:31am UTC](https://discuss.elastic.co/t/unable-to-set-sub-condition-in-condition/169400/1 "2019-02-21T11:31:55Z")

</div>

Hello folks,

I am fighting with one problem in logstash.

I would like to set a sub-condition in existing condition.

```
if [type] == "system" {
    mutate {
      rename => { "instCpu" => "cpuTotal" } 
      rename => { "sysCpu" => "cpuUsed" } 
      rename => { "sysMemTotal" => "memoryTotal" } `Preformatted text`
      rename => { "sysMem" => "memoryUsed" } 
      rename => { "instMem" => "memoryFree" } 
    }
  } else if [type] == "transaction" {
      if [legs][0][serviceName] == nil {
        mutate { add_field => { "serviceName" => "%{[legs][0][uri]}" } }
      } else {
        mutate { add_field => { "serviceName" => "%{[legs][0][serviceName]}" } }
      }
  }

```

But I am getting error:

`[2019-02-21T12:28:29,246][ERROR][logstash.agent] Cannot create pipeline {:reason=>"Expected one of #, ( at line 41, column 40 (byte 921) after filter {\n json {\n source => \"message\"\n }\n\n# mutate { \n# remove_field => [\"message\"] \n# }\n\n date {\n match => [\"time\",\"UNIX_MS\"]\n target => \"@timestamp\"\n remove_field => [\"time\"]\n }\n\n mutate {\n add_field => { \"sourceSystem\" => \"cag\" }\n add_field => { \"sourceEnvironment\" => \"dev\" }\n add_field => { \"sourceType\" => \"gbs\" }\n add_field => { \"sourceName\" => \"GBS DEV\" }\n }\n\n\n if [type] == \"system\" {\n mutate {\n rename => { \"instCpu\" => \"cpuTotal\" } \n rename => { \"sysCpu\" => \"cpuUsed\" } \n rename => { \"sysMemTotal\" => \"memoryTotal\" } \n rename => { \"sysMem\" => \"memoryUsed\" } \n rename => { \"instMem\" => \"memoryFree\" } \n }\n } else if [type] == \"transaction\" {\n if [legs][0][serviceName] == nil "}`

I have tried to find the proper syntax in documentation but without success.

Have you any idea how to fix this?

I have logstash-5.5.1

Thanks a lot  
Regards, Reddy

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 21, 2019, 2:07pm UTC](https://discuss.elastic.co/t/unable-to-set-sub-condition-in-condition/169400/2 "2019-02-21T14:07:20Z")

</div>

> [@Rudolf\_Reddy\_Macejka](#):
>
> Expected one of #, ( at line 41, column 40 (byte 921) after [...] if [legs][0][serviceName] == nil "}

Are you trying to test whether that field exists? If so you just need

```
if [legs][0][serviceName] {
    [...]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2019, 2:07pm UTC](https://discuss.elastic.co/t/unable-to-set-sub-condition-in-condition/169400/3 "2019-03-21T14:07:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.