Find length of 'tag' attribute

Elastic Stack Logstash
1

Hi,

How to find length/size of 'tag' attribute in logstash(output section)?

My scenario : All my errors are automatically puts into the 'tag' attribute by logstash & thats why I wanted to know the size of 'tag' attribute so that I will make my decision in output section whether parse record having some error or successfully done the parsing.

Thanks

2

You'd have to use a filter to e.g. add an additional tag ("too many tags") or a field that you can inspect in a conditional in the output section.

3

Ok .... but how do I increment that field in filter section, I mean how to handle it in filter section. Can you please give me some example code so that it will be more easy for me to implement it.

For example:
Data and beats_input_codec_plain_applied are added in the tags in my logstash code. But any parsing error in csv or JSON it give _csvparsefailure and _jsonparsefailure in tags field.

I want to implement output logic such a way that if two tags found insert in ElasticIndex and more than 2 tags insert in Errorindex

Thanks

4

A ruby filter containing

event.set('tag_count', event.get('tags').length)

probably works (i.e. sets the tag_count field to the number of tags in the event). Then you can use

if [tag_count] > 2 { ... }

in the output section. If you don't want to keep the tag_count field you can create it as a subfield of @metadata instead.

5

Thanks ..... Done with my work :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.