Checking for multiple strings in a conditional with logstash

Question

I would like to find the easiest way to add a field tag when a condition is true.

if [target_index] == "myindex" and 
    ("str1" in message 
    or "str2" in message
    or "str3" in message){
        mutate {
            add_tag => ["mytag"]
        }
    }

I am following the documentation listed here. However, when I restart logstash I get "LogStash::ConfigurationError. Maybe there is a better way to do this? I would appreciate any help on this.

question from:https://stackoverflow.com/questions/65836199/checking-for-multiple-strings-in-a-conditional-with-logstash

Answer 1

You need square brackets around the references to [message]

filter {
    if [target_index] == "myindex" and
("str1" in [message]
or "str2" in [message]
or "str3" in [message]){
    mutate {
        add_tag => ["mytag"]
    }
}

That said, I would write this using alternation in a regexp

if [target_index] == "myindex" and [message] =~ /str1|str2|str3/