search

logstash-plugins / logstash-filter-grok

Grok plugin to parse unstructured (log) data into something structured.
https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
Apache License 2.0
124 stars 98 forks source link

filter inclusion "in" operator doesn't work with one element #74

Closed sebbarg closed 8 years ago

sebbarg commented 8 years ago

Hi,

Running Logstash 2.2.1.

It looks like there is a problem with the "in" operator when the array being searched only contains one element. In the below example field "foo1" isn't added:

if ( "foo" in ["foo"] ) {                               
  mutate { add_field => ["foo1", "nope"] }              
}

Here it works (field "foo2" is correctly added):

if ( "foo" in ["foo", "bar"] )  {                       
  mutate { add_field => ["foo2", "yep"] }               
}

Am I missing something?

wiibaa commented 8 years ago

Hello, as this is not a grok specific issue, could you please close this in favor of upvoting https://github.com/elastic/logstash/issues/2129.

Thanks