# IN usage for multiple key word in IF condition

**URL:** <https://discuss.elastic.co/t/in-usage-for-multiple-key-word-in-if-condition/224563>\
**Category:** Logstash\
**Created:** [March 22, 2020, 2:00pm UTC](https://discuss.elastic.co/t/in-usage-for-multiple-key-word-in-if-condition/224563 "2020-03-22T14:00:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\
**Post date:** [March 22, 2020, 2:00pm UTC](https://discuss.elastic.co/t/in-usage-for-multiple-key-word-in-if-condition/224563/1 "2020-03-22T14:00:34Z")

</div>

Hi,

Below is the logstash code.. its not working.. it works with == "1 Key" but not with multiple key words using **in** Please help

```auto
output {
  if [data][data1][data3] in "key", "key-2", "key-3", "Key-4", "aaKEY" {
  elasticsearch{
    action => "index"
    hosts => "http://127.0.0.1:9200"
    index => "indx-name%{+YYYY-MM-dd}"
    }
   }

    stdout {
        codec => rubydebug
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2020, 4:43pm UTC](https://discuss.elastic.co/t/in-usage-for-multiple-key-word-in-if-condition/224563/2 "2020-03-22T16:43:33Z")

</div>

> [@Sridhar](#):
>
> if [data][data1][data3] in "key", "key-2", "key-3", "Key-4", "aaKEY" {

I am very much surprised that does not cause an error. Does it work better if you do

```
if [data][data1][data3] in ["key", "key-2", "key-3", "Key-4", "aaKEY"] {

```

---

<div class="post-metadata">

**Author:** ![Sridhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sridhar/32/64860_2.png) [@Sridhar](https://discuss.elastic.co/u/Sridhar)\
**Post date:** [March 23, 2020, 1:59am UTC](https://discuss.elastic.co/t/in-usage-for-multiple-key-word-in-if-condition/224563/3 "2020-03-23T01:59:45Z")

</div>

@Badger - Thank you So much I had used () instead of ... its working now..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2020, 1:59am UTC](https://discuss.elastic.co/t/in-usage-for-multiple-key-word-in-if-condition/224563/4 "2020-04-20T01:59:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.