Using multiple 'and' and 'or' statements in a conditional

Elastic Stack Logstash
1

What is the proper way to use multiple 'and' and 'or' statements in a conditional statement? I've looked around but do not see any examples an I've tried using things like parenthesis with no luck either.

Here is an example of what I'm trying to do:

if [service] == "user" and "ASSIGN" in [zd_junk] and "DOMAIN" in [zd_junk] or "USER" in [zd_junk]{

The line above seems to run without error but i'm worried about the order of operation used by Logstash. It appears to match this equivalent if using parenthesis:

( "user" and "ASSIGN" in [zd_junk] and "DOMAIN" in [zd_junk] ) OR ( "USER" in [zd_junk] )

What I'd like to do would be more like this:

( "user" and "ASSIGN" in [zd_junk] ) and ( "DOMAIN" in [zd_junk] ) OR "USER" in [zd_junk] )

I'm sure i'm missing something simple and would appreciate any tips.

Thanks!

2

You should just be able to use parenthesis to make it the correct statement although the one you would like it to be is missing something or has an extra parenthesis. Have you tested it yet with parenthesis?

3

Thanks for the reply. I had tried parenthesis but must have mistyped something because I was getting config errors. I tried again this morning with a fresh brain and it worked as it should.

4

Your issue was that the boolean operators (and, or) need to be lower case. Your examples had the OR in upper case.

Full operators list.

5

Thanks Alex. I actually did that on purpose to make them stand out but inadvertently failed to mention that in my original post. I'm pretty new to LogStash, however; and make plenty of other typos so far. It's a great product though.