Change a Number Field Value

[pastechecker (Charlie)]

Work with the ruby output plugin and you will see what is going on.
Most of your questions were already answered on this forum, you just have to google a bit.

Eg:

Help With Multiple If {} else if {} COnfiguration

I am seeking help with a Logstash configuration issue. Some of my syslog messages coming into my indexer are in JSON format and some are not. I am solving this using multiple if {} else if {} else {} statements after groking the syslog_message out of the event. (Is there a better way?) My problem is that this works for some of my events (e.g. player events) but not others (e.g. sysstatf events). What am I doing wrong? Here are two example input lines: <190>Jan 28 19:00:32 host2 player-player[…

Count length of field / number of characters in a field and add the result into a new field

Can you try this: filter { if [log_name] == "Microsoft-Windows-Sysmon/Operational" { ruby { code => "event['processcreate'] = event['process_command_line'].length" } } }