Change the value of a field

I have a field called showing up with a value I wish to change
clientDisabled = false}

I want to get rid of the "}" character at the end without using too complicated a method. I have tried this:

if ([clientDisabled]=="false}") {
clientDisabled => "false"
Logstash doesn't seem to like it. Is there a simpler method without any serious overhead?

You can e.g. use a mutate filter and its replace option.


Like this?

filter {
if [clientDisabled] == "false}" {
mutate {
replace => [ "clientDisabled", "false" ]

Yes, that should work.

Cool. It did


Hi Magus

What if I'm finding that there are other funny characters in there like commas, tildes etc. Will it be better to apply a kv filter instead?

Like so

if ( "DiscountBlock" in [message])
kv {
source => "message"
field_split => ",'\s{}"
remove_field => "message"

Yes, maybe.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.