Logstash compare one field with multiple value (string)