How to break long condition in logstash config

Elastic Stack Logstash
1

I have a filter section that removes a field if the event matches with regex. So my if condition is very long.

if [type] == "something" {
    if [displayName] =~ /([M-m]as|MAS)[\d]*/ or [displayName] =~ /([E-e]lk|ELK)/ or [displayName] =~ /other regex/ or [displayName] =~ /other regex/ {
        mutate {
            remove_field => ["[memory]", "[@version]"]
        }
    }
}

There are numerous displayName values comes from json array. is there another way to handle them? if there is no, how can I break the long if condition line?

Many thanks.

2

If you are always matching [displayName] then you could combine the regexps

if [displayName] =~ /(([M-m]as|MAS)[\d]*)|([E-e]lk|ELK)|.../

If you are OK with using ruby you could try something like this.

Or you could use grok

grok {
    break_on_match => false
    match => {
        "displayName" => [
            "(?<[@metadata][matched]>([M-m]as|MAS)[\d]*)",
            "(?<[@metadata][matched]>([E-e]lk|ELK)",
            ...
        ]
    }
}
if [@metadata][matched] {
    mutate {  remove_field => [ "[memory]", "[@version]" "[@metadata][matched]" ] }
}

None of which is a great improvement :frowning:

1 Like
3

They are great improvements. Thank you so much. :pray: :slightly_smiling_face:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.