diff --git a/logstash/conf.d/20-dns-syslog.conf b/logstash/conf.d/20-dns-syslog.conf
index 08daaaee60df94dbe81d06782fa2a84e57c8f244..be49924811fcbe7b05151e61b0af2d11dd863f58 100644
--- a/logstash/conf.d/20-dns-syslog.conf
+++ b/logstash/conf.d/20-dns-syslog.conf
@@ -73,7 +73,7 @@ filter {
 
 # to do cached and cached reverse
 
-      else if [message] =~ "cached" and [message] =~ "NXDOMAIN" {
+      if [message] =~ "cached" and [message] =~ "NXDOMAIN" {
         mutate {
           add_tag => [ "cached NXDOMAIN" ]
         }
@@ -91,7 +91,7 @@ filter {
         }
       }
 
-      if [request_from] and [message] =~ "query" {
+      else if [request_from] and [message] =~ "query" {
         mutate {
           add_tag => [ "request and query type" ]
         }