If condition list in field

Elastic Stack Logstash
#1

hello, is it possible to do a searching of a list in field? e.g.

filter{
    if ["a","b","c","d"] in [message]{
        mutate{
            add_field=>{"new_field"=>"%{message}"}
        }
    }
}

i want the "new_field" to be added only if at least 1 of the string in list appeared in field.

#2

No, but you can use alternation in a regexp

if [message] =~ /(a|b|c|d/ {
#3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.