In Operator Behaves Unexpectedly When Used in a Filter

Elastic Stack Logstash
1

Hello,

I just had a very strange experience debugging one of our Logstash filters and would like to know whether we could have anticipated this or encountered a known quirk or bug (we run Logstash v7.17).

Please see below simplified filter:

filter {
	if [type] == 'some_type' {
		if [some_field] in [ "some_value1", "some_value2", "some_value3" ] {
			mutate {
				add_tag => [ "some_tag1" ]
			}
		} else if [some_field] in [ "another_value1" ] {
			mutate {
				add_tag => [ "another_tag1" ]
			}
		} else {
			drop { }
		}
	}
}

If written like that, the middle else-if-block is never reached even though the docs regarding comparison operators and conditional statements led me to believe that it should.

The fix was simple enough:

		} else if [some_field] == "another_value1" {

but strangely, adding another item to the collection also made it work as expected:

		} else if [some_field] in [ "another_value1", "another_value2" ] {

Especially the latter fix has me thinking I might have stumbled upon a bug here.
Is that true or am I missing something? Does this have something to do with some backend Ruby magic I'm unaware of?

2

It is a known issue which I doubt will ever be fixed. if ... in does not work for single member arrays.

1 Like
3

Thank you very much for finding and linking that issue. I apologize for having missed this during my prior research.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.