# Using Multiple IF conditionals in Filter

**URL:** <https://discuss.elastic.co/t/using-multiple-if-conditionals-in-filter/63714>\
**Category:** Logstash\
**Created:** [October 24, 2016, 8:04am UTC](https://discuss.elastic.co/t/using-multiple-if-conditionals-in-filter/63714 "2016-10-24T08:04:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![setlem](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@setlem](https://discuss.elastic.co/u/setlem)\
**Post date:** [October 24, 2016, 8:04am UTC](https://discuss.elastic.co/t/using-multiple-if-conditionals-in-filter/63714/1 "2016-10-24T08:04:43Z")

</div>

> [@](#):
>
> if [CREATION\_DATE] == ""  
> {  
> mutate {  
> convert =\> ["CREATION\_DATE", "string"]  
> }  
> }  
> else  
> {  
> date {  
> locale =\> "en"  
> match =\> ["CREATION\_DATE", "dd-MMM-yy hh.mm.ss.SSS a"]  
> target =\> "CREATION\_DATE"  
> }  
> }
> 
> ```
> if [SUBMITTED_DATE] == "" 
> {
> mutate {
> convert => ["SUBMITTED_DATE", "string"]
> }
> }
> else
> {
> date {
> locale => "en"
> match => ["SUBMITTED_DATE", "dd-MMM-yy hh.mm.ss.SSS a"]
> target => "SUBMITTED_DATE"
> }
> }	
> 
> if [LAST_MODIFIED_DATE] == ""
> {
> mutate {
> convert => ["LAST_MODIFIED_DATE", "string"]
> }
> }
> else
> {
> date {
> locale => "en"
> match => ["LAST_MODIFIED_DATE", "dd-MMM-yy hh.mm.ss.SSS a"]
> target => "LAST_MODIFIED_DATE"
> }
> }
> 
> ```

am getting output if i have all three (CREATION\_DATE,SUBMITTED\_DATE,LAST\_MODIFIED\_DATE) in date format.If any is STRING am not getting that log file in my output.  
for ex:  
my input is

> 12-JUL-13 11.33.56.259 AM,12-JUL-13 03.59.36.136 PM,12-JUL-13 04.00.05.584 PM  
> 14-JUL-13 11.33.56.259 AM,11-JUL-13 04.00.05.584 PM  
> my output will come successfully for  
> 12-JUL-13 11.33.56.259 AM,12-JUL-13 03.59.36.136 PM,12-JUL-13 04.00.05.584 PM but NOT FOR 2nd line

In Simple,Logstash is indexing only when three if clauses have dates.  
Help me out.THanks in advance!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 24, 2016, 11:28am UTC](https://discuss.elastic.co/t/using-multiple-if-conditionals-in-filter/63714/2 "2016-10-24T11:28:59Z")

</div>

I suggest you edit your post and move it to the Logstash category since it's a Logstash question.

---

<div class="post-metadata">

**Author:** ![setlem](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@setlem](https://discuss.elastic.co/u/setlem)\
**Post date:** [October 24, 2016, 11:39am UTC](https://discuss.elastic.co/t/using-multiple-if-conditionals-in-filter/63714/3 "2016-10-24T11:39:06Z")

</div>

Thanks magnus.

---

<div class="post-metadata">

**Author:** ![setlem](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@setlem](https://discuss.elastic.co/u/setlem)\
**Post date:** [October 25, 2016, 1:34am UTC](https://discuss.elastic.co/t/using-multiple-if-conditionals-in-filter/63714/4 "2016-10-25T01:34:00Z")

</div>

sorry to trouble friends.  
As am new and don't know anyone to guide me about logstash expect this forum.

But right now am getting  
`"LogStash::ConfigurationError" it is like this. logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-2.0.6/lib/logstash/filters/mutate.rb:192:in register'" and "org/jruby/Ruby rray.java:1613:in each`  
This errors i am getting with same config file as provided above  
Thanks!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 25, 2016, 5:36am UTC](https://discuss.elastic.co/t/using-multiple-if-conditionals-in-filter/63714/5 "2016-10-25T05:36:21Z")

</div>

I don't think you're using exactly the configuration that you've posted before. What do your mutate filters look like?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/using-multiple-if-conditionals-in-filter/63714/6 "2017-07-06T04:32:58Z")

</div>