Variable value is not accesible in nested if condition

[raja_gopal]

In a nested if condition like
if [type] == "tcp"{
if [parsed_message][NotificationType] == "NOTIFY"

The if block inside "tcp" is not working since it is not getting the value of "[parsed_message][NotificationType]" but if i give the same condition like
if [parsed_message][NotificationType] == "NOTIFY" and [type] == "tcp"{
It is working fine, what is the problem here ?

[magnusbaeck (Magnus Bäck)]

Please show an example of a document that has this perceived problem so that we can try to reproduce it.

[raja_gopal]

<NotificationTime><![CDATA[1505469213]]></NotificationTime><NotificationType><![CDATA[CLEAR]]></NotificationType><OccurrenceCount><![CDATA[4]]></OccurrenceCount><Severity><![CDATA[1]]></Severity>

In this above example i am not able to use the notification type in nested if

[magnusbaeck (Magnus Bäck)]

That doesn't help without also knowing your configuration. I meant the document produced by Logstash, i.e. basically the input to the conditional that's not working. Use a stdout { codec => rubydebug } output.

[Christian_Dahlqvist]

What does the full configuration block look like? It seems like you are missing a curly brace on the second line, but I assume that could simply be a cut and paste error.

[raja_gopal]

xml {
store_xml => true
source => message
target => parsed_message
force_array => false
remove_field => "message"
}

This is my code block to parse the xml. The output block is

if [type] == "tcp"{ if [parsed_message][NotificationType] == "NOTIFY" { elasticsearch { } } }