Condition filter not working after upgrading to logstash8

Elastic Stack Logstash
1

Hi Team,
I have following configuration in my logstash.conf file.
irresepective of the value in ${ENV}, always else block is getting executed.
Same piece of code used to work with logstash older versions (2.X and 6.x).
Could you please help in this regard.

Thanks.


filter
{
	if "${ENV}" in [ “env1”, “env2" ] {
			mutate{…1}
	} else{
			mutate{…2}
        }
				
}
2

You have to show values from "IF", pls use debug mode.

From 8.4 documentation:
You can use the in operator to test whether a field contains a specific string, key, or list element. Note that the semantic meaning of in can vary, based on the target type. For example, when applied to a string. in means "is a substring of". When applied to a collection type, in means "collection contains the exact value".

3

@Rios Yes .. I am trying to match exact value of ${ENV} in the list.
exact values:

filter
{
	if "dev" in [ “dev”, “load" ] {
			mutate{…1}
	} else{
			mutate{…2}
        }
				
}

in this filter it should execute if section not else sections.. if i understand it correctly.

4

I would use with assigning to the field to check does a field exist in list of strings

  mutate {
	add_field => { "[@metadata][env]" => "${ENV}" 
	}
  }
if ( [@metadata][env] in  ["env1", "env2" ] ) {

______________________________
The sample from documentation is valid without foo in the list:

  if !("foo" in ["hello", "world"]) {
    mutate { add_tag => "shouldexist" }
  }

But not valid if "foo" value exist in the list

  if !("foo" in ["hello", "world", "foo"]) {
    mutate { add_tag => "shouldexist" }
  }

This add tags which is not OK.

          "tags" => [
        [0] "shouldexist"

This should return true, but return false and not add tag

 if ("foo" in ["hello", "world", "foo"]) {
    mutate { add_tag => "shouldexist" }
  }
5

exactly.. "foo" in ["hello", "world", "foo"] should return true but it returns false somehow. is that a bug?

6

Looks like. Maybe something else has been changed in Ruby like in Python

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.