The use of if ... in [array]

Elastic Stack Logstash
1

Hi
When using if ... in [array] for Logstash with version 8.15.0:

input { generator { count => 1 } }

filter {
  if "a" in ["a","b"] {
    mutate {
      add_field => { "test_field" => "1" }
    }
  }
}

output { 
  stdout {} 
}

my questions are:

  1. When I use this way:
if "a" in ["a","b"]

"test_field" does not appear in my test, hope someone could explain why.

  1. Puzzle with:
    if .. in [] doesn't match for single-element arrays · Issue #9932 · elastic/logstash (github.com)
    I test a different implement but same idea with my Logstash mention above, it appear that this is not true, array with one value still return as expected, like:
if "element_in_array" in [one_element_array] => true

I hope some verify or information so that myself or someone could suggest this ticket to be closed, because It make me so confuse about the use of if ... in [array].

2

The issue is that when it is ambiguous whether [ ] in a conditional is an array or a field reference, it is always resolved as a field reference. If you intend [one_element_array] to be a field reference then that would work as expected.

I am completely baffled as to why

if "a" in [ "a", "b" ] { mutate { add_tag => [ "3" ] } }

does not add the tag. Perhaps is it just too early in the morning for me to be thinking straight.

1 Like
3

Understand what you explained here, thank.
Any update for:

if "a" in [ "a", "b" ] { mutate { add_tag => [ "3" ] } }

Find anything about this strange behavior?