elastic / elastic/logstash

Logstash in check for array only works with more than 1 element

Open
#5,591 3 comments 2 reactions 0 assignees View on GitHub
breaking change bug int-shortlist
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

- Version:
- Ubuntu 16.04 LTS
- Logstash 2.3.2

Hi

I have found that multiple people ran into the issue where the in check gets confused as to what an array is.

This is treated as an array:

`
if [message] in ["a","b"] {
mutate {
add_field => { "tet" => "world2" }
}
}
`

While this is looking for a field in the event called "a":

`
if [message] in ["a"] {
mutate {
add_field => { "tet" => "world2" }
}
}
`

I asked about this here and some helpful individual managed to write a test proving that :) :

http://stackoverflow.com/questions/38146651/logstash-in-check-for-array-only-works-with-more-than-1-element

It is not reeeeaaaallly an issue that needs fixing (since the == is working fine for the second case), however I don't think this is properly documented and maybe it'll save some people a bit of trouble :)

cheers,

Artur

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.