Q: Checking for multiple strings in a conditional with logstash I would like to find the easiest way to add a field tag when a condition is true.
if [target_index] == "myindex" and 
    ("str1" in message 
    or "str2" in message
    or "str3" in message){
        mutate {
            add_tag => ["mytag"]
        }
    }

I am following the documentation listed here. However, when I restart logstash I get "LogStash::ConfigurationError. Maybe there is a better way to do this? I would appreciate any help on this.

A: You need square brackets around the references to [message]
filter {
    if [target_index] == "myindex" and
("str1" in [message]
or "str2" in [message]
or "str3" in [message]){
    mutate {
        add_tag => ["mytag"]
    }
}

That said, I would write this using alternation in a regexp
if [target_index] == "myindex" and [message] =~ /str1|str2|str3/

