Field value filter

Elastic Stack Logstash
1

Hello,

i would like to know how can i do a field value filter? for example to do drop event by field value or length of a value, and how can i do a where in filter, for example. "field value" not in [1,2,3] etc.

thanks.

2

You could define the Grok pattern with conditional fields.

IF the pattern matches x - set the value to the a 'xstring'
else you could set value to 'anotherstring'

Example
%{patternforx:xstring}| %{WORD:ystring}

3

Have you read the documentation about conditionals?

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals

1 Like
4

thank you

5

now yes :). thanks !

6

tell me, didnt see how i can get the length of a field value?

7

I think you need to use a ruby filter to check the field value length.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.