Should be fairly easy using the mutate filter. First...is having a - a requirement for the fields? If not, I'd suggest using the mutate gsub option and convert the - to a 0 if that is what the value is when the doc arrives to Logstash. That way the mapping data type for the field could be an integer vs a string which is typically preferred but not always. Second, I'd use the mutate split option to split the field if it is found not to be a - (or 0). Then you'd have an array object and you could then create new fields based on those values, i.e.
If [http_ybid] != "0" {
mutate {
add_field => {
"[http_ybid][trans]" => "%{http_ybid[0]}"
"[http_ybid][req]" => "%{http_ybid[1]"}
}
}
}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.