If statement not working with gsub

Well, I would say that is the most frequent case:
if [field] in ["apples","oranges","pineapples"] { # looks for exact match between the complete field and any of the array elements

but, checking carefully the documentation on conditionals: https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals
It also allows looking for "string in field", equivalent to the regex example you posted.

if "apple" in [field] { # will match both "apples" and "pineapples"

I would add that, working with in conditionals, there is a bug that has to be taken into account: one-element array comparison doesn't work.

if [field] in ["apples"] { # won't match even if field = "apples"


@nino
Thanks for adding your working configuration :slight_smile:

2 Likes