It seems that the "in" operator is not working in conditionals. I get
when using this filter:
I see you are running the 1.2.0.dev version.
Could you try this with the 1.2.1 stable release? it should be in there.
Indeed I tested with 1.2.2-dev yesterday and as it did not work I just recycled my older commend from LOGSTASH-661.
After cleaning my build directory and building again everything works fine. So this can be closed.
Sorry for the inconvenience.