Check if field is in array

Hi here,
Thanks in advance for your time,
I'm struggling here with a very basic thing but I keep finding examples on the web working for others and not for me ...
I'm using logstash 7.0.0 and here is my conf :

filter {
if [trip] in ["city1/city2","city1/city3","city1/city4"] {
mutate { add_field => { "tax" => 0.01 } }
mutate { convert => { "tax" => "float" } }
} else if [trip] in ["city2/city3","city2/city4"] {
mutate { add_field => { "tax" => 0.001 } }
mutate { convert => { "tax" => "float" } }
} else {
mutate { add_field => { "tax" => 0.0001 } }
mutate { convert => { "tax" => "float" } }
}
}

The else condition is always the exit of my if ... so tax = 0.0001 in my whole index
I can see 2 potential issues here : [symbol] and the slash in my strings but I've been trying many different solutions without success ...

Thanks!
Guillaume

What does the event look like on the JSON tab in kibana? You need to show us what [trip] contains.

Hi @Badger and thks for your time

Trip looks like that in my JSON tab in Kibana :
"trip": "city1/city2",
for example

If it looked like that then you would get

       "tax" => 0.01,

My guess is whilst redacting your data you have fundamentally changed it.

I have finally found this on the web using a ruby code that looks easier :

event.set('tax', [ 'city1/city2', 'city1/city3', 'city1/city4' ].include?(event.get('trip')) ? 0.001 : 0.0001)

working now
Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.