diff --git a/logstash/conf.d/20-dns-syslog.conf b/logstash/conf.d/20-dns-syslog.conf
index 51d6d2f7586a696704237002ad8586fd00922035..83cd3a408b5f947d9cfced2bb27b5d3f6b3aea9e 100644
--- a/logstash/conf.d/20-dns-syslog.conf
+++ b/logstash/conf.d/20-dns-syslog.conf
@@ -73,7 +73,7 @@ filter {
 
 # to do cached and cached reverse
 
-      else if [message] =~ "cached" and [message] =~ "NXDOMAIN" {
+      if [message] =~ "cached" and [message] =~ "NXDOMAIN" {
         mutate {
           add_tag => [ "cached NXDOMAIN" ]
         }
@@ -91,7 +91,7 @@ filter {
         }
       }
 
-      if [request_from] and [message] =~ "query" {
+      else if [request_from] and [message] =~ "query" {
         mutate {
           add_tag => [ "request and query type" ]
         }