IN usage for multiple key word in IF condition

Elastic Stack Logstash
1

Hi,

Below is the logstash code.. its not working.. it works with == "1 Key" but not with multiple key words using in Please help

output {
  if [data][data1][data3] in  "key", "key-2", "key-3", "Key-4", "aaKEY"  {
  elasticsearch{
    action => "index"
    hosts =>  "http://127.0.0.1:9200"
    index => "indx-name%{+YYYY-MM-dd}"
    }
   }

    stdout {
        codec => rubydebug
    }
}
2

I am very much surprised that does not cause an error. Does it work better if you do

if [data][data1][data3] in [ "key", "key-2", "key-3", "Key-4", "aaKEY" ] {
3

@Badger - Thank you So much I had used () instead of ... its working now..

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.