Check if string is in field

[Automation_Scripts]

Hi,

I need some help checking if a string is contained within the value of a field.

my json has a key
"log.file.path.keyword":["myfolder/mypath/mylog.log"

I tried to parse it with

filter{
if "mylog.log" in [log.file.path.keyword] {do something{}}
}

I tried also with

filter{
if "mylog.log" in [log][file][path][keyword] {do something{}}
}

In the table view I can see it named as log.file.path with the right value, but under that value there is a field called "Multi fields" with a log.file.path.keyword item having the same value as above.
Is this correct? How can i parse it correctly?

Thank you!

[Badger]

keyword is an elasticsearch construct, it does not exist in logstash. Use

if "mylog.log" in [log][file][path] {do something{}}

[Automation_Scripts]

Thank you Badger! Still doesn’t seem to find the string. In discover the field name is “log.file.path” should I try [log.file.path] ?

[Badger]

If you expand an event in the Kibana discover interface and click on the JSON tab, what does that field look like?

[Automation_Scripts]

It has

“fields”:{
 ...
 “log.file.path”:[“mydirs/mydir/myfile.log”],
“agent.type”: [“filebeat”]
...
}

[Automation_Scripts]

What is strange is that there is no tag field

[Automation_Scripts]

When i do

If ![local][file][path]{
  mutate {add_field => {“myfield” => “notthere”}}}

I receive an extra field with the value not there

[Automation_Scripts]

The field log.file.path is visible under available fields also

[Badger]

@Automation_Scripts

“log.file.path”:[“mydirs/mydir/myfile.log”]

That is an array. Use

if "mylog.log" in [log][file][path][0] {do something{}}

[Automation_Scripts]

Man u rock! You’re really awesome!!!