# How do you do multiple "OR"s in a filter?

**URL:** <https://discuss.elastic.co/t/how-do-you-do-multiple-or-s-in-a-filter/208922>\
**Category:** Logstash\
**Created:** [November 21, 2019, 3:55pm UTC](https://discuss.elastic.co/t/how-do-you-do-multiple-or-s-in-a-filter/208922 "2019-11-21T15:55:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![meatwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/meatwad/32/36031_2.png) [@meatwad](https://discuss.elastic.co/u/meatwad)\
**Post date:** [November 21, 2019, 3:55pm UTC](https://discuss.elastic.co/t/how-do-you-do-multiple-or-s-in-a-filter/208922/1 "2019-11-21T15:55:02Z")

</div>

Hi,

I currently have a filter with nine "or" statements that look for a few different strings in log messages, then applies a tag. I tried a regex similar to this, but it wasn't matching on anything:

```
if "(foo|bar|foobar)" in [message] {
  mutate {
    add_tag => "mytag" }
}

```

The only way I could get it to work is breaking them into multiple "or"s but I'm sure it's just me being an idiot and not doing something right. Any help would be GREATLY appreciated!

Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 21, 2019, 3:58pm UTC](https://discuss.elastic.co/t/how-do-you-do-multiple-or-s-in-a-filter/208922/2 "2019-11-21T15:58:54Z")

</div>

> [@meatwad](#):
>
> if "(foo|bar|foobar)" in [message] {

Try

```
if [message] =~ "(foo|bar|foobar)" {

```

"in" does array membership testing and substring matching. =~ does regexp matching.

---

<div class="post-metadata">

**Author:** ![meatwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/meatwad/32/36031_2.png) [@meatwad](https://discuss.elastic.co/u/meatwad)\
**Post date:** [November 21, 2019, 4:13pm UTC](https://discuss.elastic.co/t/how-do-you-do-multiple-or-s-in-a-filter/208922/3 "2019-11-21T16:13:20Z")

</div>

That did the trick -- thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2019, 4:26pm UTC](https://discuss.elastic.co/t/how-do-you-do-multiple-or-s-in-a-filter/208922/4 "2019-12-19T16:26:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.