Adding fields


(marc) #1

Hello there,

I want to know if there's a way to add two or more fields. We take two fields which are numbers (not string) and want to add each other into another field.
Or even more, is there a way to add a number to a field? Imagine i receive a log with a field containing a number, may i add "10" to that field?

Thanks


(Magnus B├Ąck) #2

I don't think there are any general filters for performing field arithmetics, but you can always use a ruby filter.

filter {
  ruby {
    code => "event['sum'] = event['number_field_1'] + event['number_field_2']"
  }
}

(system) #3