Adding data to additional fields depending on the content of the message


(Usmanov) #1

Hello!
I have next situation. I need to add fields to each log message if it has specific information (matching with some regexp).
Is there any possibillity to check the message to matching some regexp and if it is matched add_field with cutom information? It is possible to do this in one iteration, in one config file of logstash?
Thank you for your attention.


(Magnus B├Ąck) #2
filter {
  if [some-field] =~ /some-regexp/ {
    mutate {
      add_field => { "some-other-field" => "any string" }
    }
  }
}

(system) #3