Convert mapping in the table logstash

Elastic Stack Logstash
1

good, I need help with the mapping in logstash, I need to change certain metrics to integer, but the metrics go together in a table so it does not let me change them. I attach the configuration in logstash.

input {
  http_poller {
    urls => {
      kvh => "https://Default_Generated_Alteon_BBI_Cert:443/config/SlbStatLinkpfRServerTable"
     }
#    cacert => "/path/downloaded_cert.pem"
    truststore => "/path/downloaded_truststore.jks"
    user => "user"
    password => "secret"
    truststore_password => "secret"
    schedule => { cron => "* * * * * UTC"}
    codec => "json"
#    ssl => true
 #   ssl_certificate_verification => true
  }
}

output {
   stdout { codec => rubydebug }
 elasticsearch {
    hosts => ["https://425d6971696czcbfb23f3ef706bd675a.us-central1.gcp.cloud.es.io:9243"]
    user => "elastic"
    password => "secret"
    index => "radwareefecty"
   }

}

As you can see in the image the metrics that give number are in string, but all these metrics are in a matrix (table), I need to change them to integer, but with the filter does not let me so they are in a table and not individual.

image
image1232×572 44.4 KB

2

Can you show us the JSON tab instead of the Table tab please, and just copy the text, do not post a screenshot.

3

of course, of course, look

{
  "_index": "radwareefecty",
  "_type": "_doc",
  "_id": "mH0rXXkBQzzVpIqvCzkb",
  "_version": 1,
  "_score": null,
  "_source": {
    "SlbStatLinkpfRServerTable": [
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "N/A",
        "DnBwPeak": "0.0",
        "UpBwPeak": "0.0",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Claro-Internet4",
        "IpAddr": "190.145.144.65",
        "TotBwPeak": "0.0",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "0.0",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "0.0",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "N/A",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "N/A",
        "DnBwTot": "0.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "N/A",
        "DnBwPeak": "0.0",
        "UpBwPeak": "0.0",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Columbus-Internet5",
        "IpAddr": "190.242.127.16",
        "TotBwPeak": "0.0",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "0.0",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "0.0",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "N/A",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "N/A",
        "DnBwTot": "0.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "02:28:52 Sat May  1, 2021",
        "DnBwPeak": "0.1",
        "UpBwPeak": "1.4",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Internet_Navegacion-Claro_1",
        "IpAddr": "190.143.70.35",
        "TotBwPeak": "1.5",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "1620.9",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "1617.9",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "01:53:29 Sat May  1, 2021",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "02:28:52 Sat May  1, 2021",
        "DnBwTot": "3.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "01:52:18 Sat May  1, 2021",
        "DnBwPeak": "0.3",
        "UpBwPeak": "5.4",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Internet_Navegacion-Claro_2",
        "IpAddr": "190.144.221.225",
        "TotBwPeak": "5.8",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "130.9",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "125.7",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "01:52:18 Sat May  1, 2021",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "01:52:18 Sat May  1, 2021",
        "DnBwTot": "5.3"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "19:53:13 Wed Apr 14, 2021",
        "DnBwPeak": "0.0",
        "UpBwPeak": "0.0",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Internet_Navegacion-UNE_1",
        "IpAddr": "200.122.229.81",
        "TotBwPeak": "0.1",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "1.0",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "0.9",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "19:53:13 Wed Apr 14, 2021",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "19:53:13 Wed Apr 14, 2021",
        "DnBwTot": "0.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "01:53:34 Sat May  1, 2021",
        "DnBwPeak": "0.0",
        "UpBwPeak": "55.0",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "L2L_Claro",
        "IpAddr": "10.10.105.16",
        "TotBwPeak": "55.0",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "55.6",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "55.6",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "N/A",
        "State": 1,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "01:53:34 Sat May  1, 2021",
        "DnBwTot": "0.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "01:52:38 Sat May  1, 2021",
        "DnBwPeak": "0.0",
        "UpBwPeak": "0.8",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "L2L_CyW",
        "IpAddr": "10.10.100.16",
        "TotBwPeak": "0.8",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "3.8",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "3.8",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "N/A",
        "State": 1,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "01:52:38 Sat May  1, 2021",
        "DnBwTot": "0.0"
      }
    ],
    "@timestamp": "2021-05-11T20:41:00.284Z",
    "@version": "1"
  },
  "fields": {
    "@timestamp": [
      "2021-05-11T20:41:00.284Z"
    ]
  },
  "sort": [
    1620765660284
  ]
}
4

the number value is in string (" ")

5

OK, so it is an array of hashes... you could do

    ruby {
        code => '
            def is_number? string
                true if Float(string) rescue false
            end

            t = event.get("SlbStatLinkpfRServerTable")
            if t
                newT = []
                t.each { |x|
                    newX = {}
                    x.each { |k, v|
                        if is_number? v
                            v = v.to_f
                        end
                        newX[k] = v
                    }
                    newT << newX
                }
                t = event.set("SlbStatLinkpfRServerTable", newT)
            end
        '
    }

that will convert anything that is a valid string representation of a float (that includes integers) to a float. If you want integers to be integers you will have to have a second helper function similar to is_number? to check is_integer? and add an else branch to the if.

6

ok but how would it go in the input?

7

You would wrap it in

filter {
}

Filters are not inputs or outputs.

8

ok very thanks, I've learned , thanks you!

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.