Hi,
I need to drop some events in logtstash and for this I write a if condition if ( [externalId] != "4663" and "4662" not in [externalId] and "4728" not │le Management in [externalId] and "4769" not in [externalId] and "4698" not in [externalId] and │[2019-06-19T07:54:22,334][INFO ][logstash.outputs.elasticsearch] Attempting to inst "4672" not in [externalId] and "4625" not in [externalId] and "4624" not in [exte│all template {:manage_template=>{"index_patterns"=>["kotakbank-ad-"], "settings"=>rnalId] and "4907" not in [externalId] and "4764" not in [externalId] and "4755" │{"index"=>{"codec"=>"best_compression", "refresh_interval"=>"5s", "number_of_shardsnot in [externalId] and "4754" not in [externalId] and "4739" not in [externalId] │"=>"3", "number_of_replicas"=>"0"}}, "mappings"=>{"doc"=>{"dynamic_templates"=>[{"mand "4735" not in [externalId] and "4727" not in [externalId] and "4724" not in [│essage_field"=>{"path_match"=>"b_evt_raw_msg", "match_mapping_type"=>"string", "mapexternalId] and "4716" not in [externalId] and "4706" not in [externalId] and "47│ping"=>{"norms"=>false, "type"=>"text"}}}, {"string_fields"=>{"match"=>"", "match_94" not in [externalId] and "4765" not in [externalId] and "4719" not in [external│mapping_type"=>"string", "mapping"=>{"fields"=>{"keyword"=>{"ignore_above"=>256, "tId]) { drop { } }
but in this case all the events having externalId are drop. I think the OR condition is not working. I am using logstash version 7.1.
Please Help !!!!