Array for condition

Elastic Stack Logstash
1

Hi,

I want to drop a message if the "method" field has one of several contents. I've been searching the docs and forums for a while now but wont find the right syntax. I have this, which doesn't work:

if [ "validation", "forwarded", "cached", "query[A]", "query[AAAA]", "query[PTR]", "query[SOA]", "unknown", "dnssec-query", "<unknown>", "dnssec-query[DS]", "dnssec-query[DNSKEY]", "config"] in [method] {
          drop { } 
        }

I verified that the terms I am searching for are in the field "method".

How do I get this to work?

Thanks!

2

I believe the conditional need to be the other way around as you are comparing the content of the method field to an array of values, e.g. if [method] in ["validation", ...] {.

1 Like
3

this worked for me, thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.