Filebeat processor help

[Kay_Khan]

Hey i need some help with filebeat processors. I want to decode_json_fields if the kubernetes.container.name is equal to 1 or more values.

   processors:
      - add_cloud_metadata:
      - add_host_metadata:
      - decode_json_fields:
          when:
            equals:
              kubernetes.container.name: "entity-extractor-api-prod"
          fields: ["message"]
          process_array: false
          max_depth: 10
          target: "log"
          overwrite_keys: true
          add_error_key: true

Is it possible to set an array here?

when:
  equals:
    kubernetes.container.name: ["app1", "app2"]

[kvch (Noémi Ványi)]

Unfortunately, you cannot set an array. However, you can still accept the two names at the same time by using the or conditional:

when:
  or:
  - equals:
      kubernetes.container.name: "app1"
  - equals:
      kubernetes.container.name: "app2"