# Check if field is in array

**URL:** <https://discuss.elastic.co/t/check-if-field-is-in-array/186052>\
**Category:** Logstash\
**Created:** [June 17, 2019, 11:49am UTC](https://discuss.elastic.co/t/check-if-field-is-in-array/186052 "2019-06-17T11:49:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![GitsBdr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gitsbdr/32/58828_2.png) [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\
**Post date:** [June 17, 2019, 11:49am UTC](https://discuss.elastic.co/t/check-if-field-is-in-array/186052/1 "2019-06-17T11:49:47Z")

</div>

Hi here,  
Thanks in advance for your time,  
I'm struggling here with a very basic thing but I keep finding examples on the web working for others and not for me ...  
I'm using logstash 7.0.0 and here is my conf :

filter {  
if [trip] in ["city1/city2","city1/city3","city1/city4"] {  
mutate { add\_field =\> { "tax" =\> 0.01 } }  
mutate { convert =\> { "tax" =\> "float" } }  
} else if [trip] in ["city2/city3","city2/city4"] {  
mutate { add\_field =\> { "tax" =\> 0.001 } }  
mutate { convert =\> { "tax" =\> "float" } }  
} else {  
mutate { add\_field =\> { "tax" =\> 0.0001 } }  
mutate { convert =\> { "tax" =\> "float" } }  
}  
}

The else condition is always the exit of my if ... so tax = 0.0001 in my whole index  
I can see 2 potential issues here : [symbol] and the slash in my strings but I've been trying many different solutions without success ...

Thanks!  
Guillaume

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 17, 2019, 1:05pm UTC](https://discuss.elastic.co/t/check-if-field-is-in-array/186052/2 "2019-06-17T13:05:22Z")

</div>

What does the event look like on the JSON tab in kibana? You need to show us what [trip] contains.

---

<div class="post-metadata">

**Author:** ![GitsBdr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gitsbdr/32/58828_2.png) [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\
**Post date:** [June 17, 2019, 1:15pm UTC](https://discuss.elastic.co/t/check-if-field-is-in-array/186052/3 "2019-06-17T13:15:41Z")

</div>

Hi @Badger and thks for your time

Trip looks like that in my JSON tab in Kibana :  
"trip": "city1/city2",  
for example

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 17, 2019, 1:18pm UTC](https://discuss.elastic.co/t/check-if-field-is-in-array/186052/4 "2019-06-17T13:18:37Z")

</div>

If it looked like that then you would get

```
       "tax" => 0.01,

```

My guess is whilst redacting your data you have fundamentally changed it.

---

<div class="post-metadata">

**Author:** ![GitsBdr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gitsbdr/32/58828_2.png) [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\
**Post date:** [June 17, 2019, 1:41pm UTC](https://discuss.elastic.co/t/check-if-field-is-in-array/186052/5 "2019-06-17T13:41:58Z")

</div>

I have finally found this on the web using a ruby code that looks easier :

event.set('tax', ['city1/city2', 'city1/city3', 'city1/city4'].include?(event.get('trip')) ? 0.001 : 0.0001)

working now  
Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2019, 1:41pm UTC](https://discuss.elastic.co/t/check-if-field-is-in-array/186052/6 "2019-07-15T13:41:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.