Change the value of a field


#1

I have a field called showing up with a value I wish to change
clientDisabled = false}

I want to get rid of the "}" character at the end without using too complicated a method. I have tried this:

if ([clientDisabled]=="false}") {
clientDisabled => "false"
Logstash doesn't seem to like it. Is there a simpler method without any serious overhead?


(Magnus Bäck) #2

You can e.g. use a mutate filter and its replace option.


#3

Magnus,

Like this?

filter {
if [clientDisabled] == "false}" {
mutate {
replace => [ "clientDisabled", "false" ]
}
}
}


(Magnus Bäck) #4

Yes, that should work.


#5

Cool. It did

Thanks


#6

Hi Magus

What if I'm finding that there are other funny characters in there like commas, tildes etc. Will it be better to apply a kv filter instead?

Like so

if ( "DiscountBlock" in [message])
kv {
source => "message"
field_split => ",'\s{}"
remove_field => "message"
}


(Magnus Bäck) #7

Yes, maybe.


(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.