Condition on value in array?

Hi,

I have following fields in my event:

...
 "stage": [
      "shared",
      "QA",
      "dev_trunk"
    ],
...

I want to set a new meta field to to staging, if the stage filed contains, QA, dev_trunk or PreProd.

I have tried with following sniplet:

# process the stage
	if [stage] == "Production"
	{
		mutate
		{
			 add_field => { "[@metadata][indexCluster]" => "prod" }
		}
	}
	#elseif [stage] in ["QA", "dev_trunk", "PreProd"]
	elseif "QA" in [stage] or "dev_trunk in [stage] or "PreProd" in [stage]
	{
		mutate
		{
			add_field => { "[@metadata][indexCluster]" => "staging" }
		}
	}
	else
	{
		mutate
		{
			add_field => { "[@metadata][indexCluster]" => "no_stage_defined" }
		}
	}

The event above is resulting in "no_stage_defined".

How can I correct this?

I am using logstash 5.2.0
Thanks, Andreas

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.