Can't update or replace with a string value

Elastic Stack Logstash
1

Hello,
I have a problem, as said in the title i can't mutate a value from int to string.

I have the following line of log :

name,24/02/19,12345,123456

12345 is a number of hour and i want to convert it in Day(s), Month(s) etc...

i have the following code (i tryed with both update and replace):

    mutate {
			convert => { "rétention" => "string" }
		}
		mutate {
			replace => { "rétention" => "1 jour" }
		}

In kibana only the 1 appear, i tried with one and then there is nothing

I don't understand what i'm missing or what i'm doing wrong
In advance thanks for your help

2

You can convert hours to days using

ruby { code => 'event.set("someField", event.get("someField").to_f/24)' }

I am not sure what it means to convert it to months.

3

for exemple 24 is a day, 168 is a week, 8760 is a year etc...
I have only 8 fixed value

4

Right, but a month is a variable length of time. If you only want to days you can use the code I wrote. If you do not care about DST you can do much the same for weeks and years.

5

I don't care about DST, and i think you misunderstood me, this value is used in the legend of my graph and i want to display "1 day" or "1 year". I just want to know how to update (or replace) a field with a string value.
Anyways thanks for your help
( in my case amonth is always 30 day so it's not a problem)
To give more details i want to do something like this

     if [rétention] == "24" {
    			mutate {
    				replace => { 'rétention' => "1 day" }
    			}
    		}
    		if [rétention] == "168" {
    			mutate {
    				replace => { 'rétention' => "1 week" }
    			}
    		}
    .....
    		if [rétention] == "87600" {
    			mutate {
    				replace => { 'rétention' => "10 years" }
    			}
    		}
6

If you have a fixed set of values you want to replace then a translate filter would be more compact.

7

I tried with translate but it does not work. I have the following code:

mutate {
		add_field => { "rétentionC" => "rétention" }
	}
	mutate {
		convert => { "rétentionC" => "string" }
	}
	translate {
    field => "rétention"
    destination => "rétentionC"
    dictionary => {
      "24" => "1 jour"
      "168" => "1 semaine"
      "720" => "1 mois"
      "960" => "40 jours"
	  "2160" => "3 mois"
      "8760" => "1 année"
      "26280" => "3 années"
      "87600" => "40 jours"
    }
    fallback => "rétention invalide"
  }

but my field still have the value "rétention"

8

The first mutate copies the literal string "rétention" into a field called "rétentionC". Did you mean to copy the value of the [rétention] field?...

mutate { add_field => { "rétentionC" => "%{[rétention]}" }

I do not understand the point of the second mutate either. You are modifying a field that will always get overwritten.

The following works

input { generator { count => 1 lines => [ '' ] } }
filter {
    mutate { add_field => { "rétention" => "8760" } }
    translate {
        field => "rétention"
        destination => "rétentionC"
        dictionary => {
            "24" => "1 jour"
            "168" => "1 semaine"
            "720" => "1 mois"
            "960" => "40 jours"
            "2160" => "3 mois"
            "8760" => "1 année"
            "26280" => "3 années"
            "87600" => "40 jours"
        }
        fallback => "rétention invalide"
    }
}
9

The first mutate copies the literal string "rétention" into a field called "rétentionC". Did you mean to copy the value of the [rétention] field?...

In this case it's only a filler word

I do not understand the point of the second mutate either. You are modifying a field that will always get overwritten.

i tried to force cast with string, because i tought it was a type problem

Thanks for your solution, i'll try it monday morning.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.