Conditional mutate of values after kv{} function

[abhijitkottur]

2019-08-08 08:41:47.919 INFO [-,94a0b008e1c6714e,94a0b008e1c6714e,true] 6 --- [io-8164-exec-10] a.c.f.w.r.c.controllers.VFSController : [eventType:DELETE_FILES] [storageName:playout-dr] [deleteResult:FILE_NOT_EXISTS] [numeric_deleteCount:0]

kv {
    source => "keyValuePairs"
    field_split => " "
    trim_key => "\["
    trim_value =>  "\]"
    value_split => ":"
    remove_field => [ "keyValuePairs" ]
  }

The key-value pairs are getting extracted correctly. However, all values are being pushed as text. I want to apply a conditional mutate on the values something like this

if key starts with 'numeric_' then
mutate {
  convert => {
    "value" => "integer"
  }
}

This is because I want to apply aggregation functions on the field on Kibana which supports only numeric data.

Please advise if this is possible and if it is share the code snippet for the conditional mutation.

Thanks in advance.

[Jenni]

You could do that with Ruby:

ruby {
  code => "event.to_hash.each { |k, v | event.set(k, v.to_i) if k =~ /^numeric_/ }"
}

[abhijitkottur]

Thank you for the response.. But where do I put the mutate code block? Like this?

ruby {
  code => "event.to_hash.each { |k, v | event.set(k, v.to_i) if k =~ /^numeric_/ }" 
  mutate {
    convert => {
      "value" => "integer"
    }
  }
}

[Jenni]

The line of Ruby code already says “Loop through every field of the event and overwrite the original value with the integer value of the current field (v.to_i) if the key (k) starts with 'numeric_'”
v.to_i is the conversion. There is nothing more to add