diff --git a/pkg/query-service/app/logs/v3/enrich_query.go b/pkg/query-service/app/logs/v3/enrich_query.go
index fffdf07723..5daa6aa6a6 100644
--- a/pkg/query-service/app/logs/v3/enrich_query.go
+++ b/pkg/query-service/app/logs/v3/enrich_query.go
@@ -167,6 +167,22 @@ func jsonFilterEnrich(filter v3.FilterItem) v3.FilterItem {
 	// check if the value is a int, float, string, bool
 	valueType := ""
 	switch filter.Value.(type) {
+	// even the filter value is an array the actual type of the value is string.
+	case []interface{}:
+		// check first value type in array and use that
+		if len(filter.Value.([]interface{})) > 0 {
+			firstVal := filter.Value.([]interface{})[0]
+			switch firstVal.(type) {
+			case uint8, uint16, uint32, uint64, int, int8, int16, int32, int64:
+				valueType = "int64"
+			case float32, float64:
+				valueType = "float64"
+			case bool:
+				valueType = "bool"
+			default:
+				valueType = "string"
+			}
+		}
 	case uint8, uint16, uint32, uint64, int, int8, int16, int32, int64:
 		valueType = "int64"
 	case float32, float64:
diff --git a/pkg/query-service/app/logs/v3/enrich_query_test.go b/pkg/query-service/app/logs/v3/enrich_query_test.go
index 20b5d90487..de5e81cb7e 100644
--- a/pkg/query-service/app/logs/v3/enrich_query_test.go
+++ b/pkg/query-service/app/logs/v3/enrich_query_test.go
@@ -563,6 +563,50 @@ var testJSONFilterEnrichData = []struct {
 			Value:    10.0,
 		},
 	},
+	{
+		Name: "check IN",
+		Filter: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.attr",
+				DataType: v3.AttributeKeyDataTypeUnspecified,
+				Type:     v3.AttributeKeyTypeUnspecified,
+			},
+			Operator: "IN",
+			Value:    []interface{}{"hello", "world"},
+		},
+		Result: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.attr",
+				DataType: v3.AttributeKeyDataTypeString,
+				Type:     v3.AttributeKeyTypeUnspecified,
+				IsJSON:   true,
+			},
+			Operator: "IN",
+			Value:    []interface{}{"hello", "world"},
+		},
+	},
+	{
+		Name: "check NOT_IN",
+		Filter: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.attr",
+				DataType: v3.AttributeKeyDataTypeUnspecified,
+				Type:     v3.AttributeKeyTypeUnspecified,
+			},
+			Operator: "NOT_IN",
+			Value:    []interface{}{10, 20},
+		},
+		Result: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.attr",
+				DataType: v3.AttributeKeyDataTypeInt64,
+				Type:     v3.AttributeKeyTypeUnspecified,
+				IsJSON:   true,
+			},
+			Operator: "NOT_IN",
+			Value:    []interface{}{10, 20},
+		},
+	},
 }
 
 func TestJsonEnrich(t *testing.T) {
diff --git a/pkg/query-service/app/logs/v4/json_filter_test.go b/pkg/query-service/app/logs/v4/json_filter_test.go
index c8b2e44847..bdca6df8df 100644
--- a/pkg/query-service/app/logs/v4/json_filter_test.go
+++ b/pkg/query-service/app/logs/v4/json_filter_test.go
@@ -183,6 +183,71 @@ var testGetJSONFilterData = []struct {
 		},
 		Filter: "lower(body) like lower('%message%') AND JSON_EXISTS(body, '$.\"message\"')",
 	},
+	{
+		Name: "test json in array string",
+		FilterItem: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.name",
+				DataType: "string",
+				IsJSON:   true,
+			},
+			Operator: "in",
+			Value:    []interface{}{"hello", "world"},
+		},
+		Filter: "lower(body) like lower('%name%') AND JSON_EXISTS(body, '$.\"name\"') AND JSON_VALUE(body, '$.\"name\"') IN ['hello','world']",
+	},
+	{
+		Name: "test json in array number",
+		FilterItem: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.value",
+				DataType: "int64",
+				IsJSON:   true,
+			},
+			Operator: "in",
+			Value:    []interface{}{10, 11},
+		},
+		Filter: "lower(body) like lower('%value%') AND JSON_EXISTS(body, '$.\"value\"') AND JSONExtract(JSON_VALUE(body, '$.\"value\"'), 'Int64') IN [10,11]",
+	},
+	{
+		Name: "test json in array mixed data- allow",
+		FilterItem: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.value",
+				DataType: "int64",
+				IsJSON:   true,
+			},
+			Operator: "in",
+			Value:    []interface{}{11, "11"},
+		},
+		Filter: "lower(body) like lower('%value%') AND JSON_EXISTS(body, '$.\"value\"') AND JSONExtract(JSON_VALUE(body, '$.\"value\"'), 'Int64') IN [11,11]",
+	},
+	{
+		Name: "test json in array mixed data- fail",
+		FilterItem: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.value",
+				DataType: "int64",
+				IsJSON:   true,
+			},
+			Operator: "in",
+			Value:    []interface{}{11, "11", "hello"},
+		},
+		Error: true,
+	},
+	{
+		Name: "test json in array mixed data- allow",
+		FilterItem: v3.FilterItem{
+			Key: v3.AttributeKey{
+				Key:      "body.value",
+				DataType: "string",
+				IsJSON:   true,
+			},
+			Operator: "in",
+			Value:    []interface{}{"hello", 11},
+		},
+		Filter: "lower(body) like lower('%value%') AND JSON_EXISTS(body, '$.\"value\"') AND JSON_VALUE(body, '$.\"value\"') IN ['hello','11']",
+	},
 }
 
 func TestGetJSONFilter(t *testing.T) {