Best way to drop event based on the value(in an array) of a field

Elastic Stack Logstash
1

Hi I want to drop an event if the field "group" contains any of the values in an array, it seems that this is the way to do it, but I was wondering if this is the best way to do it, especially because the array has arround 25 elements.

 if  [group] in ["abc","def","ghi"]{ 
    drop{}
}
2

That's the way I would do it unless I had a very large number of values to check for, in which case I would use a translate filter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.