IN usage for multiple key word in IF condition


Below is the logstash code.. its not working.. it works with == "1 Key" but not with multiple key words using in Please help

output {
  if [data][data1][data3] in  "key", "key-2", "key-3", "Key-4", "aaKEY"  {
    action => "index"
    hosts =>  ""
    index => "indx-name%{+YYYY-MM-dd}"

    stdout {
        codec => rubydebug

I am very much surprised that does not cause an error. Does it work better if you do

if [data][data1][data3] in [ "key", "key-2", "key-3", "Key-4", "aaKEY" ] {

@Badger - Thank you So much I had used () instead of ... its working now..

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.