# Why i cant use if statement in grock block?

**URL:** <https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716>\
**Category:** Logstash\
**Created:** [April 19, 2018, 1:44pm UTC](https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716 "2018-04-19T13:44:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [April 19, 2018, 1:44pm UTC](https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716/1 "2018-04-19T13:44:39Z")

</div>

I want to add if statement and check condition in grok block if grok pattern is matched and add module in given json.  
Bellow Filter shows error please help.

```
   grok
   {
 
      match => { logs => "killed by TERM signal"}
      if ([boardname] =~ /^.*tester.*$/) 
      {
                add_field => {"module" => "null"}
      }
   }
```

---

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [April 19, 2018, 1:53pm UTC](https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716/2 "2018-04-19T13:53:55Z")

</div>

@Jenni @magnusbaeck

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 19, 2018, 2:08pm UTC](https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716/3 "2018-04-19T14:08:19Z")

</div>

You can not use conditionals within ANY filter definition. You can however place the conditional outside the grok filter block and use a mutate filter to add the field.

---

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [April 20, 2018, 4:46am UTC](https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716/4 "2018-04-20T04:46:30Z")

</div>

thanks @Christian_Dahlqvist  
Is this Correct way to do it?

```
 grok
{

  match => { logs => "killed by TERM signal"}
  add_tag => ["regexMatched"]
} 
if "regexMatched" in [tags]
{
        if ([boardname] =~ /^.*tester.*$/) 
       {
            add_field => {"module" => "null"}
       }
}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 20, 2018, 6:02am UTC](https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716/5 "2018-04-20T06:02:48Z")

</div>

Almost. When a grok filter fails to match any expression, it by default adds a `_grokparsefailure` tag, so you can trigger on this instead of adding a separate field if you want. You also need to wrap the `add_field` statement in a filter, e.g. `mutate`. Something like this should work:

```auto
grok {
  match => { "logs" => "killed by TERM signal"}
} 

if "_grokparsefailure" not in [tags] {
  if ([boardname] =~ /^.*tester.*$/) {
    mutate {
      add_field => {"module" => "null"}
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Post date:** [April 20, 2018, 6:30am UTC](https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716/6 "2018-04-20T06:30:13Z")

</div>

thank you @Christian_Dahlqvist it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2018, 6:30am UTC](https://discuss.elastic.co/t/why-i-cant-use-if-statement-in-grock-block/128716/7 "2018-05-18T06:30:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.