# Checking if an nested field which is an array contains a value

**URL:** <https://discuss.elastic.co/t/checking-if-an-nested-field-which-is-an-array-contains-a-value/55561>\
**Category:** Logstash\
**Created:** [July 14, 2016, 7:50pm UTC](https://discuss.elastic.co/t/checking-if-an-nested-field-which-is-an-array-contains-a-value/55561 "2016-07-14T19:50:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ramdev\_Wudali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramdev_wudali/32/7894_2.png) [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\
**Post date:** [July 14, 2016, 7:50pm UTC](https://discuss.elastic.co/t/checking-if-an-nested-field-which-is-an-array-contains-a-value/55561/1 "2016-07-14T19:50:00Z")

</div>

Hi:  
I am trying to check if a nested field in the input can be used for conditional checks and how to do it:  
here is an example logstash config :

```
input {
  generator {
    message => '{"metadata": { "origins": ["192.168.50.91"] }}'
    codec => "json"
    count => 1
  }
}

filter {
  if [metadata][origins] =~ /192\.168\.50\.91/ {
    mutate {
      add_field => ["router.cisco.hostname", "foo"]
    }
  }
}

output {
  stdout { codec => rubydebug }
}

```

In the above config, I want to be able to check if metadata.origins has a value. However upon running this, I do not get the desired output instead I get this :  
{  
"metadata" =\> {  
"origins" =\> [  
[0] "192.168.50.91"  
]  
},  
"@version" =\> "1",  
"@timestamp" =\> "2016-07-14T19:48:05.579Z",  
"host" =\> "[u0102180-maca.ten.thomsonreuters.com](http://u0102180-maca.ten.thomsonreuters.com)",  
"sequence" =\> 0  
}

instead of getting the additional field : "router.cisco.hostname" =\> "foo"  
added to the output.

what is wrong with the configuration. (its an array because there could be multiple entries in the origins array.

Thanks

Ramdev

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 15, 2016, 5:49am UTC](https://discuss.elastic.co/t/checking-if-an-nested-field-which-is-an-array-contains-a-value/55561/2 "2016-07-15T05:49:10Z")

</div>

I think either of these will work:

```nohighlight
if [metadata][origins][0] == "192.168.50.91" {
if "192.168.50.91" in [metadata][origins] {

```

The second looks at all elements of the array which is probably what you want to do. I dropped the also regexp in favor of a normal equality condition.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:47am UTC](https://discuss.elastic.co/t/checking-if-an-nested-field-which-is-an-array-contains-a-value/55561/3 "2017-07-06T04:47:58Z")

</div>