Dynamic Input for drop plugin

Elastic Stack Logstash
1

I am new to Logstash. Have a json input, I am trying to filter the content before I write the output to a file. Below is my filter --
filter {
if [msg] != "null" {
mutate {
remove_field => ["msg"]
}
}
if [rawmsg] != "null" {
mutate {
remove_field => ["rawmsg"]
}
}
if [json][action] == "/abc/process/ready" or [json][action] == "/abc/metrics/get-all" or if [json][action] == "/abc/xyz/entries/merge" {
drop{}
}
}

[json][action] element values in the if blocks can change over time so I would like to define a template file containing the list of values that can be managed by the end users and consumed by the filter. Is there a way to simple way to achieve this ? Thanks

2

You could use a translate filter to lookup the value of [json][action] and add another field that you can test when deciding whether to do the drop.

3

Thanks I will look into it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.