Conditionals not working on numeric fields

Elastic Stack Logstash
1

Hi,

I'm having an issue with conditionals and numeric fields. The config below only works if I first convert my fields to a string.

I found a blog that mentions if ([foo]) { ... } should work for numeric fields but

  if ([netflow][l4_src_port]) == "8888" {
     drop { }
  }

does not (logstash trows an error). I couldn't find anything in the Docs either.

What is the correct way to handle numeric fields and conditionals?

filter {
  if [type] == "netflow" {

   if ![netflow][ipv4_src_addr] {
     drop { }
  }

  mutate {
     convert => { "[netflow][l4_src_port]" => "string" }
     convert => { "[netflow][l4_dst_port]" => "string" }
  }

  if [netflow][l4_src_port] == "8888" {
     drop { }
  }

  if [netflow][l4_dst_port] == "8888" {
     drop { }
  }

  if [netflow][l4_src_port] == "9993" {
     drop { }
  }


  if [netflow][l4_dst_port] == "9993" {
     drop { }
  }
2

For numerical comparisons don't double-quote the operand, i.e. say 8888 instead of "8888".

3

Thanks as always. I will try that.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.