# Create arrays in Logstash

**URL:** <https://discuss.elastic.co/t/create-arrays-in-logstash/262260>\
**Category:** Logstash\
**Created:** [January 26, 2021, 4:50pm UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260 "2021-01-26T16:50:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gneves](https://avatars.discourse-cdn.com/v4/letter/g/3da27b/32.png) [@gneves](https://discuss.elastic.co/u/gneves)\
**Post date:** [January 26, 2021, 4:50pm UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260/1 "2021-01-26T16:50:53Z")

</div>

Hello guys.

Dont know if it is possible, but i would like to create an array in my logstash to use in an if statement. ill give an example for you to understand me.

Giving a random "log to be processed" as example:  
random.log:

> Timestamp: 2021-01-26T15:01:38.724Z  
> user.id: [paul@mail.com](mailto:paul@mail.com)  
> user.domain: [mail.com](http://mail.com)

i would like to create an array of users for which i would like to add a department to the logs.  
My idea would be something like this:  
logstash.conf:

```auto
    NewArrayFinance => [{paul@mail.com},{john@mail.com},{mike@mail.com}]

    filter {

        if [user][id] in [NewArrayFinace] {
            mutate{
            add_field => {"Department" => "Finance"}
            }
        }
    }

```

Later i will also create other "else if's" for other departments. Or maybe you have a easier way to do it.  
Thank you alot for your time.

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [January 27, 2021, 5:16am UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260/2 "2021-01-27T05:16:45Z")

</div>

> [@gneves](#):
>
> ` NewArrayFinance => [{paul@mail.com},{john@mail.com},{mike@mail.com}]`

Is this an actual log line? Why are the strings encapsulated in curly braces if it is a list?

---

<div class="post-metadata">

**Author:** ![gneves](https://avatars.discourse-cdn.com/v4/letter/g/3da27b/32.png) [@gneves](https://discuss.elastic.co/u/gneves)\
**Post date:** [January 27, 2021, 9:57am UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260/3 "2021-01-27T09:57:03Z")

</div>

this is actually not a log line. This is like an "example" of an array that i would like to create, with a list of "finance users". i know the brackets are wrong. And i dont even know if it is possible to create an array for me to use in the "if statement". thank you for your answer.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 27, 2021, 4:52pm UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260/4 "2021-01-27T16:52:41Z")

</div>

> [@gneves](#):
>
> ```auto
> NewArrayFinance => [{paul@mail.com},{john@mail.com},{mike@mail.com}]
> 
> filter {
> 
> if [user][id] in [NewArrayFinace] {
> 
> ```

You cannot use a variable like that, but you can do

```
if [user][id] in ["paul@mail.com", "john@mail.com", "mike@mail.com"] {

```

to do an array membership test.

---

<div class="post-metadata">

**Author:** ![gneves](https://avatars.discourse-cdn.com/v4/letter/g/3da27b/32.png) [@gneves](https://discuss.elastic.co/u/gneves)\
**Post date:** [February 1, 2021, 12:43pm UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260/5 "2021-02-01T12:43:27Z")

</div>

very grateful for your answer and id does actually work, i've tried this already before. That is actually the way that i am using. But my idea was to creat something like "some arrays in the beginning of the file, and call them later". Maybe that's not possible, i dont know. Just wanted it to be like, more organized.

Thank you so much anyways 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2021, 12:43pm UTC](https://discuss.elastic.co/t/create-arrays-in-logstash/262260/6 "2021-03-01T12:43:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.