# What does this logstash filter do?

**URL:** <https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229>\
**Category:** Logstash\
**Created:** [May 10, 2024, 6:19am UTC](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229 "2024-05-10T06:19:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![moomoo21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moomoo21/32/131084_2.png) [@moomoo21](https://discuss.elastic.co/u/moomoo21)\
**Post date:** [May 10, 2024, 6:19am UTC](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229/1 "2024-05-10T06:19:04Z")

</div>

Im having trouble understanding what does this logstash filter do:

```auto
if ("" in [somefield1][somefield2]){
    drop{}
}

```

what does "" in the field mean?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 10, 2024, 8:30am UTC](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229/2 "2024-05-10T08:30:44Z")

</div>

If the field value is the empty string [somefield1][somefield2] = "", drop the message or better to say the event. Nil is something else.

---

<div class="post-metadata">

**Author:** ![moomoo21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moomoo21/32/131084_2.png) [@moomoo21](https://discuss.elastic.co/u/moomoo21)\
**Post date:** [May 10, 2024, 9:06am UTC](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229/3 "2024-05-10T09:06:07Z")

</div>

It is "in" the string. Does that mean that _ **any** _ string will be able to be dropped?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 10, 2024, 11:05am UTC](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229/4 "2024-05-10T11:05:04Z")

</div>

> [@moomoo21](#):
>
> if ("" in [somefield1][somefield2]) { drop{} }

`in` can be used to do two things, one is array membership, the other is detecting substrings of a string. _Any_ string will contain the substring "", so yes, this is trying to drop all strings. It will also drop any string arrays that contain an empty string:

```
 input {
    generator {
        count => 1
        lines => [
            '{ "a": "Hello, world!" }',
            '{ "a": ["", "a"] }',
            '{ "a": [4, 5] }',
            '{ "a": 42 }',
            '{ "a": false }',
            '{ "a": null }'
        ]
        codec => json
    }
}

output { stdout { codec => rubydebug { metadata => false } } }
filter {
    mutate { remove_field => ["event", "host", "log"] }

    if "" in [a] { drop {} }
}

```

will only output the last four events.

---

<div class="post-metadata">

**Author:** ![moomoo21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moomoo21/32/131084_2.png) [@moomoo21](https://discuss.elastic.co/u/moomoo21)\
**Post date:** [May 10, 2024, 12:26pm UTC](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229/5 "2024-05-10T12:26:43Z")

</div>

Thanks for the reply,

would it be the same if i do

```auto
if ([somefield1][somefield2]){
    drop{}
}

```

Its essentially the same thing right? (If i know that the incoming input is in the string form)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 10, 2024, 12:30pm UTC](https://discuss.elastic.co/t/what-does-this-logstash-filter-do/359229/6 "2024-05-10T12:30:10Z")

</div>

> [@moomoo21](#):
>
> Its essentially the same thing right?

Not at all, that will drop anything where the field is not equal to nil, or, if it is a boolean field, it contains true. It would drop five of the six of the events in my example (it does not drop `{ "a": false }`.