Field value filter


(Shahar Zion) #1

Hello,

i would like to know how can i do a field value filter? for example to do drop event by field value or length of a value, and how can i do a where in filter, for example. "field value" not in [1,2,3] etc.

thanks.


(Joseph Johney) #2

You could define the Grok pattern with conditional fields.

IF the pattern matches x - set the value to the a 'xstring'
else you could set value to 'anotherstring'

Example
%{patternforx:xstring}| %{WORD:ystring}


(Magnus Bäck) #3

Have you read the documentation about conditionals?

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals


(Shahar Zion) #4

thank you


(Shahar Zion) #5

now yes :). thanks !


(Shahar Zion) #6

tell me, didnt see how i can get the length of a field value?


(Magnus Bäck) #7

I think you need to use a ruby filter to check the field value length.


(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.