Field value filter

(Shahar Zion) #1


i would like to know how can i do a field value filter? for example to do drop event by field value or length of a value, and how can i do a where in filter, for example. "field value" not in [1,2,3] etc.


(Joseph Johney) #2

You could define the Grok pattern with conditional fields.

IF the pattern matches x - set the value to the a 'xstring'
else you could set value to 'anotherstring'

%{patternforx:xstring}| %{WORD:ystring}

(Magnus Bäck) #3

Have you read the documentation about conditionals?

(Shahar Zion) #4

thank you

(Shahar Zion) #5

now yes :). thanks !

(Shahar Zion) #6

tell me, didnt see how i can get the length of a field value?

(Magnus Bäck) #7

I think you need to use a ruby filter to check the field value length.

(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.