Here is my sample data msg=key,value key2,value1 key3,value2,value3 key4,value4 My kv filter works and I end up with the result below "toplvl.midlvl" = { "key" => "value", "key2" => "value1", "key3" => "value2,value3", "key4" => "value4" } So now I want to modify the value in key3 and remove va…

I'd try to use [toplvl.midlvl][key3] to reference that field. Also, your regexp is wrong. Use e.g. .*, instead.

Can't modify field after KV filter v6.3

ryannelle (Ryan Nelle) August 28, 2018, 7:15pm 3

Thank you !!!.

That did the trick.

Topic		Replies	Views
Change the value of a field Logstash	7	19787	September 7, 2017
Use Mutate after KV filter Logstash	4	692	July 15, 2020
Dropping characters from a field Logstash	2	489	August 15, 2017
Using KV filter Logstash	4	989	July 6, 2017
Remove { and " from field name? Logstash	11	3210	December 14, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Can't modify field after KV filter v6.3

Related topics