Why '[field] in [ "value" ]' is not working as expected?

Elastic Stack Logstash
1

Hello. I have a field and I want to compare its value agains the list of another values, but this comparison does not work:
if [field] in [ "value" ]
But this works:
if [field] in [ "randomxyz", "value" ]
Why there have to be at least 2 elements? I understand the following behaviour:
if [field] in "somestringvalue"
which finds content of [field] in string "somestringvalue", but in case of array I do not get it.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.