# Drop filter for multiple names

**URL:** <https://discuss.elastic.co/t/drop-filter-for-multiple-names/153108>\
**Category:** Logstash\
**Created:** [October 19, 2018, 5:54am UTC](https://discuss.elastic.co/t/drop-filter-for-multiple-names/153108 "2018-10-19T05:54:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pavuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavuk/32/28914_2.png) [@pavuk](https://discuss.elastic.co/u/pavuk)\
**Post date:** [October 19, 2018, 5:54am UTC](https://discuss.elastic.co/t/drop-filter-for-multiple-names/153108/1 "2018-10-19T05:54:15Z")

</div>

Hi,

Could you please help me with drop logstash filter?  
I have field 'username' and I want to drop all records for specific usernames.  
Please correct my filter if it is wrong:

```
if ["Pete", "John", "Bill", "Greg", "Paul McCartney"] in [username] {
  drop { }
  }

```

Thanks.

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [October 19, 2018, 8:01am UTC](https://discuss.elastic.co/t/drop-filter-for-multiple-names/153108/2 "2018-10-19T08:01:53Z")

</div>

Right now it's  
"If the username contains this array ..."  
That a) won't happen and b) isn't valid syntax in Logstash. (I think you can not define arrays directly in the conditions?)

Three possible solutions:

1. If you had a field containing that array, you could probably write `if [username] in [namelist]`
2. You could just concatenate all your conditions :`if [username] == "Pete" or [username] == ...`
3. You could use a regular expression: `if [username] =~ /Pete|John|Bill|Greg|Paul McCartney/`

---

<div class="post-metadata">

**Author:** ![pavuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavuk/32/28914_2.png) [@pavuk](https://discuss.elastic.co/u/pavuk)\
**Post date:** [October 19, 2018, 8:32am UTC](https://discuss.elastic.co/t/drop-filter-for-multiple-names/153108/3 "2018-10-19T08:32:00Z")

</div>

Thank you! It seems solution 2 is my choice!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2018, 8:32am UTC](https://discuss.elastic.co/t/drop-filter-for-multiple-names/153108/4 "2018-11-16T08:32:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.