Can logstash get the type of field?

Elastic Stack Logstash
1

I there any way can logstash get the type of field?
for example, "age": 1, "name":"jone'
the age's type is integer, and the jone's type is string.

2

If you explain what you want to do it'll be easier to help.

3

OK, below is the problem I met.

so, I want to get the type of the field. for example, there are two different type log but with same field:
{"url":"192.168.0.1/test","user":"xiang"}}
{"url":"192.168.0.1/test","user":{"name":"xiang","age":20}}

then I use filter{ { json { source => "message" } } in logstash.
If the type of "user" is string , I save the value in field "user_name", if not ,save the value in field "user".
Do you have any suggest?

1 Like
4

Oh, okay. You need a ruby filter for this. Untested but probably works for Logstash 2.4 and later:

ruby {
  code => "
    if event.include? 'user' && event.get('user').is_a? String
      event.set('user_name', event.get('user'))
      event.remove('user')
    end
  "
}
5

Thank you ! I will try

6

there is no method "set" or "get" for LogStash::Event

I use the below code, and can run success:

ruby {
                code => "
                        if event.include?('user') && event['user'].is_a?(String)
                                event['user_name']=event['user']
                                event.remove('use')
                        end
                "
        }

thanks for your help!

7

Yes, that's what you need in Logstash 2.3 and earlier.