Checking length of a message

(Parvatayya Malimath) #1


I am creating logstash filter, for a message like below - username [24/Oct/2018:15:51:39 +0200] "POST /xyz/xyz/xyz/

i need to create a filter, which will check the length of username and create a tag (long or short) or create a field like long-username or short--username

i am kind of new to logstash and need help

My logstash conf looks like this

input {
stdin { }

filter {
grok {
match => { "message" => "%{IP:client_ip} - %{USERNAME :user}-" }

date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]

output {
stdout { codec => rubydebug }

(Walker) #2

Seems like the Range filter should do what you need.

(Parvatayya Malimath) #3

i dont have the plugin and no internet access from the machine. so is there a work around or something?

(Walker) #4

(Parvatayya Malimath) #5

I just used this. 'event.set("new_field", event.get("some_field").length())' in ruby filter
Thanks anyway

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.