Conditional match for numeric type in list?

Elastic Stack Logstash
1

Hi, Please help,

I have been struggling with this for a few days.

How can I match a numeric field against a long list of numbers?
Would it be best to use grok or ruby?

I can do it for one but there must be a more elegant way than this.
My match list is non linear so I cannot use greater than or any of the other operators.

if [filed] == 9991 {
...
} else if [field] == 5678 {
...
}
} else if [field] == 91011 {
...
}
} else if [field] == 121314 {
...
} else {
...
}

2

Try this

if [field] in [9991, 5678, 91011, 121314] {
    ...
}
else {
    ...
}

Custom Ruby code is also an option, and could be a better alternative depending on what you want to do when the value matches. If you are going to use Ruby inside the if branch to manipulate numbers, it may make sense to also have the actual check inside the Ruby block.

3

Thank you PAZ!
That seems to be working well.

Thought I tried that but must have been
if [field] == [##,##,##]

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.