# Filter elements based on array constant or array environment variable

**URL:** https://discuss.elastic.co/t/filter-elements-based-on-array-constant-or-array-environment-variable/269074
**Category:** Logstash
**Created:** [April 1, 2021, 6:52pm UTC](https://discuss.elastic.co/t/filter-elements-based-on-array-constant-or-array-environment-variable/269074 "2021-04-01T18:52:57Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Automation\_Scripts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/automation_scripts/32/85374_2.png) [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)
#### Post date: [April 1, 2021, 6:52pm UTC](https://discuss.elastic.co/t/filter-elements-based-on-array-constant-or-array-environment-variable/269074/1 "2021-04-01T18:52:57Z")

</div>

Hi guys,

How can I use an array constant in Logstash's filter?  
In my .env file I have a constant  
`BLACKLIST=192.168.3.131, 10.0.0.1`

```auto
      if [id.orig_h] in [${BLACKLIST}] {
        drop {}
      } 

```

How can we declare an array as constant to use it within the filtering?  
I've tried with `[${BLACKLIST}]` or `${BLACKLIST}` but without luck 🙂

Any help is much appreciated!

Thank you!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 1, 2021, 7:41pm UTC](https://discuss.elastic.co/t/filter-elements-based-on-array-constant-or-array-environment-variable/269074/2 "2021-04-01T19:41:53Z")

</div>

> [@Automation\_Scripts](#):
>
> How can we declare an array as constant to use it within the filtering?

In general you cannot. logstash will treat the substituted environment variable as a string, not an array. There is a very specific [case](https://github.com/elastic/logstash/pull/12051) (plugin options that use `:list => true` and `:validate => :uri`) where it will get converted to an array but that is the only case that I know of.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 29, 2021, 7:41pm UTC](https://discuss.elastic.co/t/filter-elements-based-on-array-constant-or-array-environment-variable/269074/3 "2021-04-29T19:41:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.