IN usage for multiple key word in IF condition

[Sridhar (Sridhar B)]

Hi,

Below is the logstash code.. its not working.. it works with == "1 Key" but not with multiple key words using in Please help

output {
  if [data][data1][data3] in  "key", "key-2", "key-3", "Key-4", "aaKEY"  {
  elasticsearch{
    action => "index"
    hosts =>  "http://127.0.0.1:9200"
    index => "indx-name%{+YYYY-MM-dd}"
    }
   }

    stdout {
        codec => rubydebug
    }
}

[Badger]

@Sridhar

if [data][data1][data3] in "key", "key-2", "key-3", "Key-4", "aaKEY" {

I am very much surprised that does not cause an error. Does it work better if you do

if [data][data1][data3] in [ "key", "key-2", "key-3", "Key-4", "aaKEY" ] {

[Sridhar (Sridhar B)]

@Badger - Thank you So much I had used () instead of ... its working now..