Condition check

Elastic Stack Logstash
1

I have a field name errorcode which is of type NUMBER. How do i check the starting first digit of errorcode and place it as a ciondition in if statement.

2

Regular expressions, supported in conditionals, are good at checking against patterns but only work against STRINGs; the following will add a metadata field that is a string representation of errorcode, then use it in the if clause.

if [errorcode]
  mutate {
    add_field => {
      "[@metadata][error_code_string]" => "%{errorcode}"
    }
  }
  if [@metadata][error_code_string] =~ /^7/ {
    # ... this will only be executed if the `errorcode` starts with 7.
  }
}
3

are you missing a { somewhere?

4

So, if it is any other variable type than string,a direct condition check cant be done. It has to be converted to string first.

5

Just to check
=~ meaning contains
/^7/ meaning starting with 7
%{errorcode} meaning string type of errorcode

what if i want to check ending with 7, is it /$7/ or what if it is just has to contain 7 in any part, is it /7/?

6

to clarify:

  • =~ means "matches the following regular expression"
  • /^7/ is a regular expression.
    • ^ in regular expressions, the up-carat is a beginning-of-line matcher
    • so /^7/ means "a sequence of characters that starts with 7"
  • %{errorcode} is used inside a sprintf format string as a part of add_field; when executed, it substitutes the value of the errorcode field. This is the method I used to convert the integer to string.
7
  • a regular expression that matches any string ending with 7 would be /7$, since the dollar symbol in regular expressions means end-of-line.
  • a regular expression matching any string that contains a 7 would be /7/.

More can be learned about regular expressions at http://regular-expressions.info/

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.