Logstash if condition

Elastic Stack Logstash
2

As you have found, you cannot use a sprintf reference directly in a conditional, and I do not think you can use nested sprintf references such as

%{[processes]["%{[process][hash][md5]}"][paths]}

Something you could try is

ruby {
    code => '
        hash = event.get("[process][hash][md5]")
        paths = event.get("[processes][#{hash}][paths]")
        event.set("[@metadata][paths]", paths)
    '
}
if [process][executable] not in [@metadata][paths] {