Logstash in check for array only works with more than 1 element
- Dominant language
- Java
- Stars
- 14.9k
- Forks
- 3.5k
- Avg merge
- 19h 14m
- Merged PRs (30d)
- 63
Description
- Version:
- Ubuntu 16.04 LTS
- Logstash 2.3.2
Hi
I have found that multiple people ran into the issue where the in check gets confused as to what an array is.
This is treated as an array:
`
if [message] in ["a","b"] {
mutate {
add_field => { "tet" => "world2" }
}
}
`
While this is looking for a field in the event called "a":
`
if [message] in ["a"] {
mutate {
add_field => { "tet" => "world2" }
}
}
`
I asked about this here and some helpful individual managed to write a test proving that :) :
http://stackoverflow.com/questions/38146651/logstash-in-check-for-array-only-works-with-more-than-1-element
It is not reeeeaaaallly an issue that needs fixing (since the == is working fine for the second case), however I don't think this is properly documented and maybe it'll save some people a bit of trouble :)
cheers,
Artur
Contributor guide
Assessment
This issue has not been assessed yet.