Converting value in field

Elastic Stack Logstash
1

Hi i am having a log list like this

<#> 20200924 15:14:44.552 000000997 FD.WRN [ MVINB-LSL2.T1G1_ATMTH_SL main.main ConfigService.ConfigService ] Unable to get CommonParamConfig of [DAC_TEST_WHILE_IDLE, *]. Memory table not loaded yet

<#> 20200924 15:14:44.529 000000997 FD.INF [ MVINB-LSL2.T1G1_ATMTH_SL main.main ConfigService.ConfigService ] Update Switched Flag.

I want to convert the all the value with "FD.WRN" with "Warning" and "FD.INF" as "Info" and display as "warning" "Info" in the kibana. is there any way?

2

If you are parsing out that field, then you could use a translate filter. If you are just passing the message through then you could use mutate+gsub.

3

Thank you so much @Badger :star_struck: Got the respective output by using mutating and gsub => [ "event_type" , "FD.WRN" , "Warning"]
gsub => [ "event_type" , "EV.WRN" , "Warning"]

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.