# Logstash add field default type is string but check field in an array field must match type **URL:** \ **Category:** Logstash\ **Created:** [September 4, 2021, 7:34am UTC](https://discuss.elastic.co/t/logstash-add-field-default-type-is-string-but-check-field-in-an-array-field-must-match-type/283334 "2021-09-04T07:34:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![qinkkai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qinkkai/32/94160_2.png) [@qinkkai](https://discuss.elastic.co/u/qinkkai)\ **Post date:** [September 4, 2021, 7:34am UTC](https://discuss.elastic.co/t/logstash-add-field-default-type-is-string-but-check-field-in-an-array-field-must-match-type/283334/1 "2021-09-04T07:34:35Z")
My logstash config as follow，I want to output only when the field a in the arr. I think the condition in the output is always true. ```auto input { generator { message => '{"a":111}' codec => json add_field => { "arr" => [111,222,333] } count => 1 } } output { if [a] in [arr] { stdout {codec => rubydebug} } } ``` But when I run logstash，I find there is nothing output ```auto [root@10-205-205-105 logstash-test-7.14.0]# bin/logstash -f config/demo.conf Using JAVA_HOME defined java: /vdb/jdk-11 WARNING, using JAVA_HOME while Logstash distribution comes with a bundled JDK OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. /vdb/logstash-test-7.14.0/vendor/bundle/jruby/2.5.0/gems/bundler-1.17.3/lib/bundler/rubygems_integration.rb:200: warning: constant Gem::ConfigMap is deprecated Sending Logstash logs to /vdb/logstash-test-7.14.0/logs which is now configured via log4j2.properties [2021-09-04T15:22:37,652][INFO][logstash.runner] Log4j configuration path used is: /vdb/logstash-test-7.14.0/config/log4j2.properties [2021-09-04T15:22:37,666][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.14.0", "jruby.version"=>"jruby 9.2.19.0 (2.5.8) 2021-06-15 55810c552b OpenJDK 64-Bit Server VM 11+28 on 11+28 +indy +jit [linux-x86_64]"} [2021-09-04T15:22:38,137][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2021-09-04T15:22:39,868][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9601} [2021-09-04T15:22:40,904][INFO][org.reflections.Reflections] Reflections took 113 ms to scan 1 urls, producing 120 keys and 417 values [2021-09-04T15:22:42,202][INFO][logstash.javapipeline][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1000, "pipeline.sources"=>["/vdb/logstash-test-7.14.0/config/demo.conf"], :thread=>"#"} [2021-09-04T15:22:43,160][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>0.95} [2021-09-04T15:22:43,194][INFO][logstash.javapipeline][main] Pipeline started {"pipeline.id"=>"main"} [2021-09-04T15:22:43,264][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]} [2021-09-04T15:22:43,474][INFO][logstash.javapipeline][main] Pipeline terminated {"pipeline.id"=>"main"} [2021-09-04T15:22:43,861][INFO][logstash.pipelinesregistry] Removed pipeline from registry successfully {:pipeline_id=>:main} [2021-09-04T15:22:43,919][INFO][logstash.runner] Logstash shut down. ``` Then I remove the if condition run again: ```auto output { # if [a] in [arr] { stdout {codec => rubydebug} # } } ``` ```auto { "@timestamp" => 2021-09-04T07:24:40.521Z, "a" => 111, "arr" => [ [0] "111", [1] "222", [2] "333" ], "@version" => "1", "host" => "10-205-205-105", "sequence" => 0 } ``` I noticed that the item type in 'arr' field is string, but the 'a' field is integer. I guess maybe the type is not match cause the if condition is false, so I change the type of 'a' to string. ```auto input { generator { message => '{"a":"111"}' codec => json add_field => { "arr" => [111,222,333] } count => 1 } } output { if [a] in [arr] { stdout {codec => rubydebug} } } ``` The if condition is true, and the console print the message ```auto { "a" => "111", "sequence" => 0, "arr" => [ [0] "111", [1] "222", [2] "333" ], "@version" => "1", "@timestamp" => 2021-09-04T07:29:34.794Z, "host" => "10-205-205-105" } ``` But my input message field type is a integer(in json format) and I need check if in some values. Is there have some solutions ? > Sorry for any mistakes. English is not my native language ---
**Author:** ![qinkkai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qinkkai/32/94160_2.png) [@qinkkai](https://discuss.elastic.co/u/qinkkai)\ **Post date:** [September 4, 2021, 7:56am UTC](https://discuss.elastic.co/t/logstash-add-field-default-type-is-string-but-check-field-in-an-array-field-must-match-type/283334/2 "2021-09-04T07:56:24Z")
I add a convert, convert arr to integer, it works well ```auto input { generator { message => '{"a":111}' codec => json add_field => { "arr" => [111,222,333] } count => 1 } } filter { mutate { convert => { "arr" => "integer" } } } output { if [a] in [arr] { stdout {codec => rubydebug} } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 2, 2021, 7:56am UTC](https://discuss.elastic.co/t/logstash-add-field-default-type-is-string-but-check-field-in-an-array-field-must-match-type/283334/3 "2021-10-02T07:56:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.