Change the value of a field

Elastic Stack Logstash
1

I have a field called showing up with a value I wish to change
clientDisabled = false}

I want to get rid of the "}" character at the end without using too complicated a method. I have tried this:

if ([clientDisabled]=="false}") {
clientDisabled => "false"
Logstash doesn't seem to like it. Is there a simpler method without any serious overhead?

2

You can e.g. use a mutate filter and its replace option.

3

Magnus,

Like this?

filter {
if [clientDisabled] == "false}" {
mutate {
replace => [ "clientDisabled", "false" ]
}
}
}

4

Yes, that should work.

5

Cool. It did

Thanks

6

Hi Magus

What if I'm finding that there are other funny characters in there like commas, tildes etc. Will it be better to apply a kv filter instead?

Like so

if ( "DiscountBlock" in [message])
kv {
source => "message"
field_split => ",'\s{}"
remove_field => "message"
}

7

Yes, maybe.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.