logstash filter if else