Conditional Filter in pipeline

Elastic Stack Elasticsearch
1

Dear All,
I'm new in Eleastic environment. I need an help if it is possible. I create a pipeline to process the data from filebeat system, my pipeline works correctly I'm processing various parameters, one of them is an integer value or special character ("-"). I process it as follow

us=%{INT:Param}

it works when parameter is a integer value but does not work when the value is ("-").
Is it possible to create a conditional event as example
if value == "-" {
Param ="-1"
} else {
%{INT:Param}
}

Thanks for your help
best regards

2

Is this a logstash or an Elasticsearch question? Can you please share a full example in order to reproduce? Thank you!

3

Hello,
This is Elastic question.
I'm trying to create a pipeline to filter some data from nginx log (this is a custom log).
I have to filter a value us="XXX" were it can have two different values type:

  • first case us="0.221"
  • second case us="-"

I do not have problem in first case but if it is possible I would set us="-1" (or 0) in second case

Thanks for your time

4

Try this snippet

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": [
            "%{WORD:my_integer} %{GREEDYDATA:name}"
          ]
        }
      },
      {
        "convert": {
          "field": "my_integer",
          "type": "integer",
          "on_failure": [
            {
              "set": {
                "field": "error",
                "value": -1
              }
            }
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "123 foo bar"
      }
    },
    {
      "_source": {
        "message": "foo spameggs"
      }
    }
  ]
}
5

Thank you so much I'll do ASAP

6

Hello,
I tried and it's works
thank you so much

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.