# with\_subelements works where loop with subelements filter fails

**URL:** <https://forum.ansible.com/t/with-subelements-works-where-loop-with-subelements-filter-fails/28770>\
**Category:** Ansible Project\
**Created:** [October 11, 2018, 9:14pm UTC](https://forum.ansible.com/t/with-subelements-works-where-loop-with-subelements-filter-fails/28770 "2018-10-11T21:14:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Guy\_Knights1](https://avatars.discourse-cdn.com/v4/letter/g/82dd89/32.png) [@Guy\_Knights1](https://forum.ansible.com/u/Guy_Knights1)\
**Post date:** [October 11, 2018, 9:14pm UTC](https://forum.ansible.com/t/with-subelements-works-where-loop-with-subelements-filter-fails/28770/1 "2018-10-11T21:14:15Z")

</div>

I have the following tasks in a block, which I’ve modified to use the new ‘loop’ structure:

`

- name: process ipv6 rules if they exist  
block:
- name: create all ipv6 firewall log statements from ‘firewall’ variable  
iptables:  
ip\_version: ipv6  
comment: “{{ item.0.comment|default(omit) }}”  
destination: “{{ item.0.destination|default(omit) }}”  
destination\_port: “{{ item.0.destination\_port|default(omit) }}”  
source: “{{ item.1 }}”  
source\_port: “{{ item.0.source\_port|default(omit) }}”  
protocol: “{{ item.0.protocol|default(omit) }}”  
jump: “LOG”  
chain: “{{ item.0.chain|default(‘INPUT’) }}”  
ctstate: “{{ item.0.state|default(‘NEW’) }}”  
in\_interface: “{{ item.0.in\_interface|default(omit) }}”  
out\_interface: “{{ item.0.out\_interface|default(omit) }}”  
limit: “3/minute”  
limit\_burst: 10

# log\_prefix: "[FIREWALL] " # ( will be added in ansible 2.5 )

state: present  
when: item.0.log is defined and item.0.log == ‘yes’  
loop: “{{ firewall6.rules|subelements(‘source’) }}”  
notify:

- save ip6tables

- name: apply ipv6 rules using ‘firewall’ variable defined in inventory vars  
iptables:  
ip\_version: ipv6  
comment: “{{ item.0.comment|default(omit) }}”  
destination: “{{ item.0.destination|default(omit) }}”  
destination\_port: “{{ item.0.destination\_port|default(omit) }}”  
source: “{{ item.1 }}”  
source\_port: “{{ item.0.source\_port|default(omit) }}”  
protocol: “{{ item.0.protocol|default(omit) }}”  
jump: “{{ item.0.rule|default(‘ACCEPT’) }}”  
chain: “{{ item.0.chain|default(‘INPUT’) }}”  
ctstate: “{{ item.0.state|default(omit) }}”  
in\_interface: “{{ item.0.in\_interface|default(omit) }}”  
out\_interface: “{{ item.0.out\_interface|default(omit) }}”  
state: present  
loop: “{{ firewall6.rules|subelements(‘source’) }}”  
notify:

- save ip6tables

when: firewall6 is defined and firewall6.rules is defined  
`

When I run this I get the following error:

`TASK [firewall : create all ipv6 firewall log statements from 'firewall' variable] ************************************* fatal: [172.20.0.88]: FAILED! => {"msg": "obj must be a list of dicts or a nested dict"} fatal: [172.20.0.77]: FAILED! => {"msg": "obj must be a list of dicts or a nested dict"} fatal: [172.20.0.55]: FAILED! => {"msg": "obj must be a list of dicts or a nested dict"}`

I changed the first task to use ‘with\_subelements’ as follows:

`

- name: create all ipv6 firewall log statements from ‘firewall’ variable  
iptables:  
ip\_version: ipv6  
comment: “{{ item.0.comment|default(omit) }}”  
destination: “{{ item.0.destination|default(omit) }}”  
destination\_port: “{{ item.0.destination\_port|default(omit) }}”  
source: “{{ item.1 }}”  
source\_port: “{{ item.0.source\_port|default(omit) }}”  
protocol: “{{ item.0.protocol|default(omit) }}”  
jump: “LOG”  
chain: “{{ item.0.chain|default(‘INPUT’) }}”  
ctstate: “{{ item.0.state|default(‘NEW’) }}”  
in\_interface: “{{ item.0.in\_interface|default(omit) }}”  
out\_interface: “{{ item.0.out\_interface|default(omit) }}”  
limit: “3/minute”  
limit\_burst: 10

# log\_prefix: "[FIREWALL] " # ( will be added in ansible 2.5 )

state: present  
when: item.0.log is defined and item.0.log == ‘yes’  
with\_subelements:

- “{{ firewall6.rules }}”
- source  
notify:
- save ip6tables  
`

When I re-run the playbook it now skips the task, as intended:

`TASK [firewall : create all ipv6 firewall log statements from 'firewall' variable] ************************************* skipping: [172.20.0.88] skipping: [172.20.0.77] skipping: [172.20.0.55]`

Can anyone tell me why this is happening?

Thanks,  
Guy

---

<div class="post-metadata">

**Author:** ![Guy\_Knights1](https://avatars.discourse-cdn.com/v4/letter/g/82dd89/32.png) [@Guy\_Knights1](https://forum.ansible.com/u/Guy_Knights1)\
**Post date:** [October 11, 2018, 9:23pm UTC](https://forum.ansible.com/t/with-subelements-works-where-loop-with-subelements-filter-fails/28770/2 "2018-10-11T21:23:40Z")

</div>

Also of note: firewall6.rules doesn’t exist on any of the hosts I’m running this playbook against, so it should be skipping the entire block, but it’s not.