Drop filter for multiple names

[pavuk (Igor Gubaidullin)]

Hi,

Could you please help me with drop logstash filter?
I have field 'username' and I want to drop all records for specific usernames.
Please correct my filter if it is wrong:

if ["Pete", "John", "Bill", "Greg", "Paul McCartney"] in [username] {
  drop { }
  }

Thanks.

[Jenni]

Right now it's
"If the username contains this array ..."
That a) won't happen and b) isn't valid syntax in Logstash. (I think you can not define arrays directly in the conditions?)

Three possible solutions:

1. If you had a field containing that array, you could probably write if [username] in [namelist]
2. You could just concatenate all your conditions :if [username] == "Pete" or [username] == ...
3. You could use a regular expression: if [username] =~ /Pete|John|Bill|Greg|Paul McCartney/

[pavuk (Igor Gubaidullin)]

Thank you! It seems solution 2 is my choice!