How to check column quantity in a filter?

Elastic Stack Logstash
1

Hello,

I'm receiving logs from a firewall and i want to sort the different types of logs based on the quantity of columns (columns created using cvs with autogenerate on) they have, instead of doing it based on the column values. Something like:

                          if number_of_columns == 30:
                                                do this because it's the type of log that has 30 columns

Is there some kind of way to do this?

Thanks!

2

Is this what you want?

ruby {
    code => "event.set('[@metadata][colcount]',event.to_hash.length)"
 }
3

Yes, thank you very much!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.