# Working with subfields in logstash **URL:** \ **Category:** Logstash\ **Created:** [October 5, 2017, 1:22pm UTC](https://discuss.elastic.co/t/working-with-subfields-in-logstash/102844 "2017-10-05T13:22:53Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![maxf](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@maxf](https://discuss.elastic.co/u/maxf)\ **Post date:** [October 5, 2017, 1:22pm UTC](https://discuss.elastic.co/t/working-with-subfields-in-logstash/102844/1 "2017-10-05T13:22:53Z")
Hello. Im using logstash to parse sysmon events. So i cant correctly use condition if and change subfields. What am i doing wrong? my config: > filter { > if [log\_name] == "Microsoft-Windows-Sysmon/Operational" and [event\_id] == 1 { > mutate { > add\_field =\> {"whitelisted" =\> "false"} > convert =\> { "whitelisted" =\> "string" } > } > } > } > if [log\_name] == "Microsoft-Windows-Sysmon/Operational" and [event\_id] == 1 { > if "true" not in [whitelisted] { > jdbc\_streaming { > jdbc\_driver\_library =\> "/etc/logstash/conf.d/mysql-connector-java-5.1.44/mysql-connector-java-5.1.44-bin.jar" > jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" > jdbc\_connection\_string =\> "" > jdbc\_user =\> "" > jdbc\_password =\> "" > cache\_size =\> 1500 > cache\_expiration =\> 600 > statement =\> "select test\_sp(:image) as 'sp\_out'" > parameters =\> { "image" =\> "[event\_data][Image]"} > target =\> "sqlfiltered" > } > } > mutate { > convert =\> { "[sqlfiltered][sp\_out]" =\> "string" } > } > if "%{[sqlfiltered][sp\_out]}" == 'true' { > mutate { > replace =\> { "sp\_out" =\> "test" } > } > } > if "true" in "%{[sqlfiltered][sp\_out]}" > { > mutate { replace =\> { "whitelisted" =\> "true" }} > } > } And my output is like > {"computer\_name":"test2.test.info","process\_id":1912,"level":"Information","log\_name":"Microsoft-Windows-Sysmon/Operational","record\_number":"55909","event\_data":{"ParentImage":"C:\Windows\explorer.exe","LogonGuid":"{4B1AF279-B975-59C0-0000-002093790600}","User":"test\user","IntegrityLevel":"High","TerminalSessionId":"2","ParentProcessId":"3188","Image":"C:\Users\user\Desktop\winrar-x64-501ru.exe","ProcessGuid":"{4B1AF279-2FC5-59D6-0000-0010968DD30E}","UtcTime":"2017-10-05 13:12:37.323","CurrentDirectory":"C:\Users\user\Desktop\","CommandLine":""C:\Users\user\Desktop\winrar-x64-501ru.exe" ","Hashes":"MD5=BD37829CB1CAF78743A928E0A64D6DFE","ProcessId":"4380","ParentCommandLine":"C:\Windows\Explorer.EXE","ParentProcessGuid":"{4B1AF279-B978-59C0-0000-0010ACC50600}","LogonId":"0x67993"},"message":"Process Create:\nUtcTime: 2017-10-05 13:12:37.323\nProcessGuid: {4B1AF279-2FC5-59D6-0000-0010968DD30E}\nProcessId: 4380\nImage: C:\Users\user\Desktop\winrar-x64-501ru.exe\nCommandLine: "C:\Users\user\Desktop\winrar-x64-501ru.exe" \nCurrentDirectory: C:\Users\user\Desktop\\nUser: test\user\nLogonGuid: {4B1AF279-B975-59C0-0000-002093790600}\nLogonId: 0x67993\nTerminalSessionId: 2\nIntegrityLevel: High\nHashes: MD5=BD37829CB1CAF78743A928E0A64D6DFE\nParentProcessGuid: {4B1AF279-B978-59C0-0000-0010ACC50600}\nParentProcessId: 3188\nParentImage: C:\Windows\explorer.exe\nParentCommandLine: C:\Windows\Explorer.EXE","type":"wineventlog","opcode":"Info","sqlfiltered":[{"sp\_out":"true"}],"version":5,"tags":["beats\_input\_codec\_plain\_applied"],"thread\_id":4344,"@timestamp":"2017-10-05T13:12:37.324Z","task":"Process Create (rule: ProcessCreate)","event\_id":1,"provider\_guid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","@version":"1","beat":{"hostname":"test1","name":"test1","version":"5.6.0"},"host":"test1","whitelisted":"false","user":{"identifier":"S-1-5-18","domain":"NT AUTHORITY","name":"SYSTEM","type":"User"},"source\_name":"Microsoft-Windows-Sysmon"} so we see, [sqlfiltered][sp\_out] = true , but if "%{[sqlfiltered][sp\_out]}" == 'true' and if "true" in "%{[sqlfiltered][sp\_out]}" are false ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 5, 2017, 1:39pm UTC](https://discuss.elastic.co/t/working-with-subfields-in-logstash/102844/2 "2017-10-05T13:39:01Z")
Do this instead: ``` if [sqlfiltered][sp_out] == 'true' ``` ---
**Author:** ![maxf](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@maxf](https://discuss.elastic.co/u/maxf)\ **Post date:** [October 5, 2017, 1:45pm UTC](https://discuss.elastic.co/t/working-with-subfields-in-logstash/102844/3 "2017-10-05T13:45:59Z")
not helps. i changed to > if [sqlfiltered][sp\_out] == 'true' > { > mutate { replace =\> { "whitelisted" =\> "true" }} > } but its still in output > "sqlfiltered":[{"sp\_out":"true"}], > "whitelisted":"false" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 5, 2017, 2:32pm UTC](https://discuss.elastic.co/t/working-with-subfields-in-logstash/102844/4 "2017-10-05T14:32:37Z")
`sqlfiltered` is an array so you need this: ``` if [sqlfiltered][0][sp_out] == 'true' ``` ---
**Author:** ![maxf](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@maxf](https://discuss.elastic.co/u/maxf)\ **Post date:** [October 5, 2017, 2:39pm UTC](https://discuss.elastic.co/t/working-with-subfields-in-logstash/102844/5 "2017-10-05T14:39:11Z")
thanks a lot. it works and im happy ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 2, 2017, 2:39pm UTC](https://discuss.elastic.co/t/working-with-subfields-in-logstash/102844/6 "2017-11-02T14:39:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.