Adding field for string length

Elastic Stack Logstash
1

Hello,

Newbie here. I'm trying to add a field to hold the string length of another field in my input. I want to visualize the string lengths (to show average email message sizes by user for example).

I have tried the following but it puts "%{contents.length}" into the contentLength field.

mutate {
add_field => {"contentLength" => "%{contents.length}"}
}

Is there a way to do this? I could not find a way to do it in Kibana, so I figured I'd move down the stack. Any help would be greatly appreciated.

Thanks

Mark

2

Use a ruby filter:

ruby {
  code => "event['contentLength'] = event['contents'].length"
}
3

Perfect. Thank you very much.