Drop event by field type

Elastic Stack Elasticsearch
1

How to drop the indexing event if the field is not integer ? in the below example i had used 123 it works . if i use abc that event should drop.

POST _ingest/pipeline/_simulate
{
  "docs": [
  {
       "_source": {
         "message": """123"""}
     }
  ],
  "pipeline":{
    "description" : "Messaging tracking ingestion",
    "processors" : [
      
      {
        "convert" : {
          "field" : "message",
          "type" : "integer",
          "ignore_missing" : true
        }
      }
    ]
  }
}
2

I would try this.

    "processors": [
      {
        "drop": {
          "if": """
            !ctx.message.chars().allMatch( Character::isDigit )
          """
        }
      }
    ]
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.