Curious to know where we place, this code. Reason of asking this question is:-
If we place the code in filter section after mentioning the column(refer my below my logstash.config), it throws an error.
Can we place it before column field ? if yes, please share the sample.
Piece of my logstash.config file
filter{
csv {
separator => ","
# skip_empty_columns => true
columns => [ "Month", "Quarter", "Year", "INCIDENT_ID" , "RESOLUTION", "SUMMARY"]
}
mutate {convert => ["Month", "integer"]}
mutate {convert => ["Quarter", "integer"]}
mutate {convert => ["Year", "integer"]}
mutate {gsub => ["RESOLUTION", "['"\\]","0"]
mutate {gsub => ["SUMMARY", "['"\\]","0"]
}