Add Field With Logsstah If It Does Not Exist

(Tony Chirillo) #1

We send log data to Logstash through Winlogbeat, and we add a field to the data.

fields:
campus: mu

We want the Logstash filter to add the field “campus” and set the value to null or unknown if the field does not exist. Doing so would be helpfull if the winlogbeat.yml file is incorrect on a system.

Does anyone have any suggestions on how to do so?

Our current Logstash filter is:

filter {

if [event_id] == 4624 or [event_id] == 4625 or [event_id] == 4648 or [event_id] == 4688 {

truncate {

id => "truncate_long"

fields => "message"

length_bytes => 200

}

}

}

We tried this, but it did not work.

filter {

if [event_id] == 4624 or [event_id] == 4625 or [event_id] == 4648 or [event_id] == 4688 {
truncate {
id => "truncate_long"
fields => "message"
length_bytes => 200
}
}
if ![fields][campus] {
mutate { add_field => { "fields.campus" => "unk" } }
}
}

(Tony Chirillo) #2

NM - we got it now. Had to do this instead.

if ![fields][campus] {
mutate { add_field => { "[fields][campus]" => "unk" } }
}

(system) closed #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.