Nand and xor operators not working

AFAICT this is a bug in Logstash. I've reported it as github.com/elastic/logstash issue #4012. You can obviously work around the bug by rewriting the expression.