luc1
July 17, 2019, 2:04pm
1
Hello,
In my logstash filter I created a new field with a condition which works.
if "ntf" in [entities][sdn]{
mutate{add_field=>["VNFc","ntf"]}}
Now, this VNFc field appear with a "?" in Kibana, so it can't be use for a control visualization ... I tried to put :
mutate {convert => {"VNFc" => "string"}}
}
But if the field is created after the parsing I guess it can't work.
[entities][sdn] is a string field though, but VNFc isn't.
Ty for your help
Badger
July 17, 2019, 2:18pm
2
If you do a refresh on the index pattern in Kibana does it fix that?
luc1
July 17, 2019, 3:08pm
3
no it doesn't
I even created a new index to test
luc1
July 17, 2019, 3:41pm
4
Ok i commented a line which was :
#mutate {split => { "[entities][sdn]"=>"/"}
and it worked, thanks for your response though
system
(system)
Closed
August 14, 2019, 3:41pm
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.