Check if field is in array

Elastic Stack Logstash
1

Hi here,
Thanks in advance for your time,
I'm struggling here with a very basic thing but I keep finding examples on the web working for others and not for me ...
I'm using logstash 7.0.0 and here is my conf :

filter {
if [trip] in ["city1/city2","city1/city3","city1/city4"] {
mutate { add_field => { "tax" => 0.01 } }
mutate { convert => { "tax" => "float" } }
} else if [trip] in ["city2/city3","city2/city4"] {
mutate { add_field => { "tax" => 0.001 } }
mutate { convert => { "tax" => "float" } }
} else {
mutate { add_field => { "tax" => 0.0001 } }
mutate { convert => { "tax" => "float" } }
}
}

The else condition is always the exit of my if ... so tax = 0.0001 in my whole index
I can see 2 potential issues here : [symbol] and the slash in my strings but I've been trying many different solutions without success ...

Thanks!
Guillaume

2

What does the event look like on the JSON tab in kibana? You need to show us what [trip] contains.

3

Hi @Badger and thks for your time

Trip looks like that in my JSON tab in Kibana :
"trip": "city1/city2",
for example

4

If it looked like that then you would get

       "tax" => 0.01,

My guess is whilst redacting your data you have fundamentally changed it.

5

I have finally found this on the web using a ruby code that looks easier :

event.set('tax', [ 'city1/city2', 'city1/city3', 'city1/city4' ].include?(event.get('trip')) ? 0.001 : 0.0001)

working now
Thanks