# Using multiple 'and' and 'or' statements in a conditional **URL:** \ **Category:** Logstash\ **Created:** [April 7, 2016, 8:38pm UTC](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741 "2016-04-07T20:38:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![djhart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djhart/32/8990_2.png) [@djhart](https://discuss.elastic.co/u/djhart)\ **Post date:** [April 7, 2016, 8:38pm UTC](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741/1 "2016-04-07T20:38:44Z")
What is the proper way to use multiple 'and' and 'or' statements in a conditional statement? I've looked around but do not see any examples an I've tried using things like parenthesis with no luck either. Here is an example of what I'm trying to do: if [service] == "user" and "ASSIGN" in [zd\_junk] and "DOMAIN" in [zd\_junk] or "USER" in [zd\_junk]{ The line above seems to run without error but i'm worried about the order of operation used by Logstash. It appears to match this equivalent if using parenthesis: ( "user" and "ASSIGN" in [zd\_junk] and "DOMAIN" in [zd\_junk] ) OR ( "USER" in [zd\_junk] ) What I'd like to do would be more like this: ( "user" and "ASSIGN" in [zd\_junk] ) and ( "DOMAIN" in [zd\_junk] ) OR "USER" in [zd\_junk] ) I'm sure i'm missing something simple and would appreciate any tips. Thanks! ---
**Author:** ![marke72](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marke72/32/10832_2.png) [@marke72](https://discuss.elastic.co/u/marke72)\ **Post date:** [April 7, 2016, 9:27pm UTC](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741/2 "2016-04-07T21:27:15Z")
You should just be able to use parenthesis to make it the correct statement although the one you would like it to be is missing something or has an extra parenthesis. Have you tested it yet with parenthesis? ---
**Author:** ![djhart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djhart/32/8990_2.png) [@djhart](https://discuss.elastic.co/u/djhart)\ **Post date:** [April 8, 2016, 1:28pm UTC](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741/3 "2016-04-08T13:28:19Z")
Thanks for the reply. I had tried parenthesis but must have mistyped something because I was getting config errors. I tried again this morning with a fresh brain and it worked as it should. ---
**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\ **Post date:** [April 8, 2016, 1:44pm UTC](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741/4 "2016-04-08T13:44:39Z")
Your issue was that the boolean operators (and, or) need to be lower case. Your examples had the OR in upper case. [Full operators list](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals). ---
**Author:** ![djhart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djhart/32/8990_2.png) [@djhart](https://discuss.elastic.co/u/djhart)\ **Post date:** [April 8, 2016, 7:47pm UTC](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741/5 "2016-04-08T19:47:52Z")
Thanks Alex. I actually did that on purpose to make them stand out but inadvertently failed to mention that in my original post. I'm pretty new to LogStash, however; and make plenty of other typos so far. It's a great product though. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741/6 "2017-07-06T05:03:05Z")