Journalbeat processor logical operators fail with expanded notation

  • Version: 7.6.1
  • Operating System: Ubuntu 16.04

Creating a journalbeat configuration using logical operators according to the documentation causes failures:

processors:
  - drop_event:
      when:
        or:
          - equals:
              systemd.unit: "another-random.service"
          - equals:
              systemd.unit: "journalbeat.service"

On start: Exiting: error initializing processors: failed to initialize condition: missing or invalid condition

Collapsing the equals into dot-notated entries works:

processors:
  - drop_event:
      when:
        or:
          - equals.systemd.unit: "another-random.service"
          - equals.systemd.unit: "journalbeat.service"

Huge thanks to mark54g and csaide for help with the workaround!