Field - Limit length

Elastic Stack Logstash
1

Hello,

Is it possible to limit the length of a field ?

I am using Logstash 5.2.1.

M.

2

Yes, but I'm pretty sure no standard filter can do it. You'll have to use a ruby filter. I think examples of that have been posted here in the past.

3

Yes I saw this in the previous posts

ruby {
       code => "
          event['message'] = event['message'][0..9999]
          event.tag 'long message'
       "
  }

However, when I start Logstash, I get this message :

Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event     get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details

But in the documentation, nothing about length limitation method.

M.

4

You need to use the new event API and replace event[x] with either event.get(x) or event.set(x, y): https://www.elastic.co/guide/en/logstash/current/event-api.html

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.