Search code examples
logstashlogstash-configuration

Logstash config: conditional with list not working if [field] in ["list item 1"]

I am using Logstash to process some flow data. Now I came across a problem while tagging the data using a conditional.

If I write the following in the logstash config

if [myfield] == "abc"{ mutate { add_tag => ["mytag"] } }
else { mutate { add_tag => ["not_working"] } }

everything works just fine, but now I want to use a list like

if [myfield] is in ["abc"]{ mutate { add_tag => ["mytag"] } }
else { mutate { add_tag => ["not_working"] } }

and only get a not_working tag.

Any suggestions? Thanks in advance!

Solution

  • It seems as if there has to be more than one value in the array/list. You could just duplicate the only value like

    if [myfield] in ["abc", "abc"] { mutate { add_tag => ["mytag"] } }
else { mutate { add_tag => ["not_working"] } }

    and it is working fine.