in/not in operator and single element lists

Description

Assuming the following test configuration, neither of the two in/not in conditionals work as expected when supplied with a list of values containing only a single (matching) element:

I get:

Either removing the "[]"'s to flatten the list into a string or adding additional values to make the list contain more than one element fixes the conditionals and they work as expected.

I've tried poking about with the internals under lib/logstash/config/* however I'm not entirely sure where/what the bug is. My current hunch is the parser is perhaps getting confused between list and field syntax?

Either way, the parser accepts the syntax but it doesn't work as expected.

Gliffy Diagrams

Activity

Show:

Philippe Weber January 27, 2015 at 5:06 AM

Matt Dainty May 12, 2014 at 2:01 PM

I realised the --debug flag spits out the expanded grammar, and now I can see why it doesn't work:

So it looks my hunch was right, it's trying to look up a field called literally "'bar'" (as opposed to just "bar"). With that I worked out where the problem was in the grammar definition and I've created PR #1361 which fixes it.

Philippe Weber May 12, 2014 at 1:24 PM

You have indeed spotted a bug where the config parser get confused and interpret the single-value array as a field reference.
For information you can see the generated pipeline using the --debug flag and see that event("bar") is called instead of using a static array.

As a workaround, adding a dummy extra-value to the array should give you the expected result

Duplicate

Details

Assignee

Reporter

Affects versions

Created May 12, 2014 at 11:37 AM
Updated January 27, 2015 at 5:06 AM
Resolved January 27, 2015 at 5:06 AM