jason27
(Griffin Jason)
September 26, 2018, 3:49pm
1
Hello, I will like to strip off the last character for a field and I donot know why this is not working in logstash.
I have a field named "app_name" which ends with something like "dashboard_webapp:" and I will like to strip-off the colon ":" at the end
I am using the gsub filter like this gsub => ["app_name", ":$", ""]
and it doesn't work.
Entire block
mutate { gsub => ["app_name", ":$", ""] }
Can someone please suggest a proper way to achieving this?
Thanks
yaauie
(Ry Biesemeyer)
September 26, 2018, 5:47pm
2
I just tried your input on Logstash 6.4.0, and it seems to work as intended.
╭─{ yaauie@castrovel:~/src/elastic/discuss-scratch/150047-mutate-gsub-trailing-colon }
╰─○ echo '{"app_name":"dashboard_webapp:"}' | ${LOGSTASH_HOME}/bin/logstash -e 'input { stdin { codec => json } } filter { mutate { gsub => ["app_name", ":$", ""] } }'
Sending Logstash logs to /Users/yaauie/src/elastic/releases/logstash-6.4.0/logs which is now configured via log4j2.properties
[2018-09-26T17:43:45,404][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-09-26T17:43:45,913][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.4.0"}
[2018-09-26T17:43:48,264][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2018-09-26T17:43:48,383][INFO ][logstash.inputs.stdin ] Automatically switching from json to json_lines codec {:plugin=>"stdin"}
[2018-09-26T17:43:48,436][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x3b09a39d run>"}
[2018-09-26T17:43:48,505][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2018-09-26T17:43:49,079][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
{
"app_name" => "dashboard_webapp",
"@version" => "1",
"@timestamp" => 2018-09-26T17:43:48.578Z,
"host" => "castrovel.local"
}
[2018-09-26T17:43:49,195][INFO ][logstash.pipeline ] Pipeline has terminated {:pipeline_id=>"main", :thread=>"#<Thread:0x3b09a39d run>"}
[success (21.000s)]
What version of Logstash are you using?
${LOGSTASH_HOME}/bin/logstash --version
What version of the Mutate filter plugin does it have loaded?
${LOGSTASH_HOME}/bin/logstash-plugin list --verbose logstash-filter-mutate
1 Like
jason27
(Griffin Jason)
September 27, 2018, 8:16am
3
yaauie:
/bin/logstash --version
Hello @yaauie , this is a fresh installation I did this week
Logstash version : 6.4.1
Mutate filter plugin: 3.3.3
jason27
(Griffin Jason)
September 27, 2018, 2:22pm
4
Apparently, my setup did not work because I had multiple gsub lines
in one mutate filter.
system
(system)
Closed
October 25, 2018, 2:22pm
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.