Checking length of a message


I am creating logstash filter, for a message like below - username [24/Oct/2018:15:51:39 +0200] "POST /xyz/xyz/xyz/

i need to create a filter, which will check the length of username and create a tag (long or short) or create a field like long-username or short--username

i am kind of new to logstash and need help

My logstash conf looks like this

input {
stdin { }

filter {
grok {
match => { "message" => "%{IP:client_ip} - %{USERNAME :user}-" }

date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]

output {
stdout { codec => rubydebug }

Seems like the Range filter should do what you need.

i dont have the plugin and no internet access from the machine. so is there a work around or something?

I just used this. 'event.set("new_field", event.get("some_field").length())' in ruby filter
Thanks anyway

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.