# How to differentiate between field references and list memberships with "in"/"not in"? **URL:** \ **Category:** Logstash\ **Created:** [January 7, 2019, 6:45pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-field-references-and-list-memberships-with-in-not-in/163257 "2019-01-07T18:45:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![skierx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skierx/32/38522_2.png) [@skierx](https://discuss.elastic.co/u/skierx)\ **Post date:** [January 7, 2019, 6:45pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-field-references-and-list-memberships-with-in-not-in/163257/1 "2019-01-07T18:45:01Z")
If I have a sample event: ``` { "client" => "someone" } ``` I'm curious as to what is going on in the following logstash configurations. Configuration A: ``` if [client] not in ["someone", "foo"] { // do something... } ``` Configuration B: ``` if [client] not in ["someone"] { // do something... } ``` In A, the conditional is true, but in B it is not. The only thing I can think of is that in B it's treating "someone" as a field. Is there a way to force it to be treated as a single element list? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 7, 2019, 8:48pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-field-references-and-list-memberships-with-in-not-in/163257/2 "2019-01-07T20:48:36Z")
If you are using "not in" then I would not expect A to match 😉 Configuration A is testing whether the value of the client field is in a set of strings. You want configuration B to test whether the value of the client field is a particular string. Why not use == ? ---
**Author:** ![skierx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skierx/32/38522_2.png) [@skierx](https://discuss.elastic.co/u/skierx)\ **Post date:** [January 7, 2019, 9:27pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-field-references-and-list-memberships-with-in-not-in/163257/3 "2019-01-07T21:27:05Z")
I want both A and B to test for membership in a list of strings, the only difference between them is the number of elements in the list. I'm generating the lists dynamically using another templating language so I could detect the single element case and have a condition for that to use "==" and if it's more than one use "in", but I'm wondering if there is a cleaner way to go about that. I suppose another way to ask the question is can I use "in" with single element lists? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 7, 2019, 9:31pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-field-references-and-list-memberships-with-in-not-in/163257/4 "2019-01-07T21:31:49Z")
I am not an expert in how logstash parses its configuration, but I cannot find a way to get it to parse it the way you want. ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [January 8, 2019, 1:17pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-field-references-and-list-memberships-with-in-not-in/163257/5 "2019-01-08T13:17:21Z")
Your thought process is correct, but you've probably stumbled on this issue [1](https://github.com/elastic/logstash/issues/9932) , [2](https://github.com/elastic/logstash/issues/9820). One solution proposed in there is to add a preset "dummy" value in the array, so it will never be a single-element one. Otherwise, if your _//Do something_ part is not very large, you could perform the same check using custom Ruby code. ---
**Author:** ![skierx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skierx/32/38522_2.png) [@skierx](https://discuss.elastic.co/u/skierx)\ **Post date:** [January 8, 2019, 3:09pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-field-references-and-list-memberships-with-in-not-in/163257/6 "2019-01-08T15:09:59Z")
Thank you for the replies. I'm going to go with the dummy value approach. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 5, 2019, 3:10pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-field-references-and-list-memberships-with-in-not-in/163257/7 "2019-02-05T15:10:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.