Hi,
I have a filter which check all inbound fields for leading underscores and if it finds any changes the underscore to other text.
I'd like to tag messages that have been modified with a tag. How do I do this? Atm, this tag is marking everything as modified regardless of whether it was changed or not.
if event['tags']
event['tags'] << 'mytag'
else
event['tags'] = ['mytag']
end
It works like this: If event['tags'] is truthy the parenthesized expression evaluates to event['tags'] and we append "mytag". If it's not truthy it's ORed with an empty list (effectively initializing event['tags'] with that list) and then the expression evaluates to that.
Any suggestions on how can I extend this to work for Logstash 5.x? In Logstash 5.x, direct field references have been disabled in favor of using event get and set methods.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.