Condicional if with Regex

Elastic Stack Logstash
1

Hi everybody,

Does anyone know how can I build a "if" condicional that logstash change de number "1" to string "Worked" ?

As example, the input are lines like:

hello,ola,1hi,1
1,red1,1,green
1
...

and the output i would like is:

hello,ola,1hi,Worked
Worked,red1,Worked,green
Worked
...

I have tried many configurations but always appear a error. Example of configurations i have tried:

if [some_field] =~ /(^1$|^1,.*|*.,1,.*|*.,1$)/ {
...

or

if [some_field] =~ /^1$/ or [some_field] =~ /^1,.*/ or  [some_field] =~ /*.,1,.*/ or  [some_field] =~ /*.,1$/ {
...
2

You could try using that regexp in a mutate+gsub filter.

3

Hi Bagder,

I gave this example to make it easier to understand but the focus is use this regexp in if conditional.

if I do your suggest, gsub will modify my "some_field" and i dont want it.
I need to use this regexp in "if condicional" to use gsub to modify another field.

Like (this "if" does not work :frowning:) :

if [m3ua.message_class] =~ /(^1$|^1,.*|*.,1,.*|*.,1$)/ {
   mutate {
       gsub => [
            "m3ua.message_type", "^1$", "DUNA_destination_unavailable_1",
            "m3ua.message_type", "^1,", "DUNA_destination_unavailable_1,",
            "m3ua.message_type", ",1,", ",DUNA_destination_unavailable_1,",
            "m3ua.message_type", ",1$", ",DUNA_destination_unavailable_1",
            "m3ua.message_type", "^2$", "DAVA_destination_available_2",
            "m3ua.message_type", "^2,", "DAVA_destination_available_2,",
            "m3ua.message_type", ",2,", ",DAVA_destination_available_2,",
            "m3ua.message_type", ",2$", ",DAVA_destination_available_2",
            "m3ua.message_type", "^3$", "DAUD_Destination_state_audit_3",
            "m3ua.message_type", "^3,", "DAUD_Destination_state_audit_3,",
            "m3ua.message_type", ",3,", ",DAUD_Destination_state_audit_3,",
            "m3ua.message_type", ",3$", ",DAUD_Destination_state_audit_3",
            "m3ua.message_type", "^4$", "SCON_SS7_signalling_congestion_state_4",
            "m3ua.message_type", "^4,", "SCON_SS7_signalling_congestion_state_4,",
            "m3ua.message_type", ",4,", ",SCON_SS7_signalling_congestion_state_4,",
            "m3ua.message_type", ",4$", ",SCON_SS7_signalling_congestion_state_4"
       ]
   }
}
4

You do not have to match the entire field. Try /(^1$|^1,|,1,|,1$)/

5

It works Badger !!

Thanks !!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.