Filter elements based on array constant or array environment variable

Elastic Stack Logstash
1

Hi guys,

How can I use an array constant in Logstash's filter?
In my .env file I have a constant
BLACKLIST=192.168.3.131, 10.0.0.1

      if [id.orig_h] in [${BLACKLIST}] {
        drop {}
      }

How can we declare an array as constant to use it within the filtering?
I've tried with [${BLACKLIST}] or ${BLACKLIST} but without luck :slight_smile:

Any help is much appreciated!

Thank you!

2

In general you cannot. logstash will treat the substituted environment variable as a string, not an array. There is a very specific case (plugin options that use :list => true and :validate => :uri) where it will get converted to an array but that is the only case that I know of.