# Array for condition

**URL:** <https://discuss.elastic.co/t/array-for-condition/161054>\
**Category:** Logstash\
**Created:** [December 16, 2018, 10:01pm UTC](https://discuss.elastic.co/t/array-for-condition/161054 "2018-12-16T22:01:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![andre22](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@andre22](https://discuss.elastic.co/u/andre22)\
**Post date:** [December 16, 2018, 10:01pm UTC](https://discuss.elastic.co/t/array-for-condition/161054/1 "2018-12-16T22:01:07Z")

</div>

Hi,

I want to drop a message if the "method" field has one of several contents. I've been searching the docs and forums for a while now but wont find the right syntax. I have this, which doesn't work:

```
if ["validation", "forwarded", "cached", "query[A]", "query[AAAA]", "query[PTR]", "query[SOA]", "unknown", "dnssec-query", "<unknown>", "dnssec-query[DS]", "dnssec-query[DNSKEY]", "config"] in [method] {
          drop { } 
        }

```

I verified that the terms I am searching for are in the field "method".

How do I get this to work?

Thanks!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 17, 2018, 7:33am UTC](https://discuss.elastic.co/t/array-for-condition/161054/2 "2018-12-17T07:33:20Z")

</div>

I believe the conditional need to be the other way around as you are comparing the content of the `method` field to an array of values, e.g. `if [method] in ["validation", ...] {`.

---

<div class="post-metadata">

**Author:** ![andre22](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@andre22](https://discuss.elastic.co/u/andre22)\
**Post date:** [December 20, 2018, 8:21pm UTC](https://discuss.elastic.co/t/array-for-condition/161054/3 "2018-12-20T20:21:05Z")

</div>

this worked for me, thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2019, 8:21pm UTC](https://discuss.elastic.co/t/array-for-condition/161054/4 "2019-01-17T20:21:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.