title: Logstash filter query with if else
body: <p>I am facing issues with Logstash filters:
  I want to put a condition like following:</p>
  <pre><code>filter {
         if [SPCI] == 79 {
              mutate {
                   replace =&gt; { &quot;RSRP79&quot; =&gt; &quot;%{SRSRP}&quot; }
                   replace =&gt; { &quot;RSRQ79&quot; =&gt; &quot;%{SRSRQ}&quot; }
                     }
         }
  </code></pre>
  <p>My dataset looks like:</p>
  <pre><code>{
    &quot;took&quot;: 29,
    &quot;timed_out&quot;: false,
    &quot;_shards&quot;: {
      &quot;total&quot;: 1,
      &quot;successful&quot;: 1,
      &quot;skipped&quot;: 0,
      &quot;failed&quot;: 0
    },
    &quot;hits&quot;: {
      &quot;total&quot;: 22656,
      &quot;max_score&quot;: null,
      &quot;hits&quot;: [
        {
          &quot;_index&quot;: &quot;processed.radiosignal&quot;,
          &quot;_type&quot;: &quot;_doc&quot;,
          &quot;_id&quot;: &quot;v_FJQnYBEKhQVcwaCsCy&quot;,
          &quot;_version&quot;: 26,
          &quot;_score&quot;: null,
          &quot;_source&quot;: {
            &quot;ElapsedRT&quot;: 0,
            &quot;Alt&quot;: 0,
            &quot;Row&quot;: 0,
            &quot;RSRP116&quot;: &quot;0&quot;,
            &quot;NRSRP&quot;: -103,
            &quot;@version&quot;: &quot;1&quot;,
            &quot;Handover&quot;: 0,
            &quot;Time&quot;: &quot;2020.12.08-11.34.49.14&quot;,
            &quot;NRSRQ&quot;: -13,
            &quot;SPCI&quot;: 79,
            &quot;SRSRP&quot;: -100,
            &quot;@timestamp&quot;: &quot;2020-12-15T17:31:29.080Z&quot;,
            &quot;SRSRQ&quot;: -11,
            &quot;RSRP79&quot;: &quot;0&quot;,
            &quot;NPLMN&quot;: &quot;nullnull&quot;,
            &quot;NPCI&quot;: 116,
            &quot;RSRQ116&quot;: &quot;0&quot;,
            &quot;Lat&quot;: 0,
            &quot;Long&quot;: 0,
            &quot;RSRQ79&quot;: &quot;0&quot;
          },
          &quot;fields&quot;: {
            &quot;@timestamp&quot;: [
              &quot;2020-12-15T17:31:29.080Z&quot;
            ]
          },
          &quot;sort&quot;: [
            1608053489080
          ]
        }
  </code></pre>
  <p>The query is not performing as expected and <code>if SRSRP == 79</code> is failing.
  I am quite new to ELK and could not understand where is the issue.
  Just to clarify, I am creating <code>RSRP79</code> and <code>RSRQ79</code> fields using alter plugin in previous step and it is working fine.</p>