Conditional filter in logstash

Elastic Stack Logstash
1

Hi and thanks for reading, i really appreciate that.
I continue having troubles with logstash filters. In this case, i don't know how to handle conditionals with arrays.
I have this field "amavis_action" and its content may be something like this:

 "amavis_action" => [
                 [0] "position0"
                 [1] "position1"
 ]

Or

"amavis_action" => [0] "Onlyposition0",

I need to made a condition like this

if ([amavis_action] =~ "[position0, position1]") {...}
else if ([amavis_action] =~ "Onlyposition0") {...}}

Which is the correct syntax for this?
Thanks!!

2

It's not obvious what the conditional you're looking for is supposed to do. Do you want to check if the amavis_action field is exactly equal to e.g. ["position0", "position1"] or ["Onlyposition0"]?

3

Thanks for reply. Actually, i want to do both. These are two possibilities, two cases that i want to evaluate.

4

I'd expect

if [amavis_action] == ["position0", "position1"] { ... }

to work but I haven't tried.