Change field value within to another value

Elastic Stack Logstash
1

Good day

Could someone please let me know what filter plugin or process I would need to do to change a field value.

By this I mean I have a column that I want to input via csv, I am good and using the filter csv plugin and then the mutate command to change the data_type.

However my challenge is I have three field values in the data that are basically "field1" , "field2", "field3" but in essence they are the same value that I want to aggregate.

What can I do to change them to the same value at the filter stage, like an if then statement or something?

Appreciate the help :slight_smile:

2

This would be a lot easier to answer if you would show us what the event currently looks like

output { stdout { codec => rubydebug } }

and explain more explicitly what you want to change.

3

Thank you for your response. Essentially this is a not an event its company commission data in csv format. The problem I'm facing is that three field values of the companies are different but they are in essence the same company.

I cannot change the source as we receive it, but I would like to make sense of it before I output to elasticsearch.

4

I am still not clear on what your data looks like or what you want to change, but perhaps a translate filter could help you normalize the naming.

5

Thank you I believe this might do it. Apologies I could not be clear enough, I will rely the example.

I have one company called ABC, I receive 100s millions of rows of commission statements. Some providers call company ABC, another name like XYZ or DEF. I need to take those values and call it company ABC.

Thank you again.

6

Look into the translate filter.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.