How do you do multiple "OR"s in a filter?

Elastic Stack Logstash
1

Hi,

I currently have a filter with nine "or" statements that look for a few different strings in log messages, then applies a tag. I tried a regex similar to this, but it wasn't matching on anything:

if "(foo|bar|foobar)" in [message] {
  mutate {
    add_tag => "mytag" }
}

The only way I could get it to work is breaking them into multiple "or"s but I'm sure it's just me being an idiot and not doing something right. Any help would be GREATLY appreciated!

Thanks!

2

Try

if [message] =~ "(foo|bar|foobar)" {

"in" does array membership testing and substring matching. =~ does regexp matching.

3

That did the trick -- thank you very much!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.