# Using conditional statement in grok
**URL:** https://discuss.elastic.co/t/using-conditional-statement-in-grok/175816
**Category:** Logstash
**Created:** [April 8, 2019, 10:38am UTC](https://discuss.elastic.co/t/using-conditional-statement-in-grok/175816 "2019-04-08T10:38:25Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)
#### Post date: [April 8, 2019, 10:38am UTC](https://discuss.elastic.co/t/using-conditional-statement-in-grok/175816/1 "2019-04-08T10:38:25Z")
I am having a log which contains some lines which are entirely different from remaining lines.
could you please help me with, how can i use conditional statement like if under filter conditions
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [April 8, 2019, 3:07pm UTC](https://discuss.elastic.co/t/using-conditional-statement-in-grok/175816/2 "2019-04-08T15:07:35Z")
Hi @Vikash_Singh1,
you can use `|` as an _or_ and it is also possible to make parts _optional_ with `()?`
```
COMMONAPACHELOGMULTICLIENTIP (%{IPORHOST:clientip}(.{1,2})?)+ %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)
```
E.g. the above pattern ends in an optional field that can be a number or `-`
Not sure what documentation would be best for info... I'm sure Google knows or maybe just a forum search here.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 6, 2019, 3:07pm UTC](https://discuss.elastic.co/t/using-conditional-statement-in-grok/175816/3 "2019-05-06T15:07:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.