Add new field based on value in event_data


(Micke) #1

Hi,
Trying to add a new field IF event_data.Status is a specific value. Cant figure out the syntax for Logstash.
Anyone?

/Maekee


(Andrew Kroh) #2

You can use a conditional mutate filter.

filter {
  if [event_data][Status] == "some value" {
    mutate {
        add_field => [ "myfield", "foobar" ]
    }   
  }
}

(Micke) #3

Thanks alot Andrew, just now found the exact same solution.
Appreciate it!!!


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.