How to convert KVpair value from string to an integer in logstash pipeline

Elastic Stack Logstash
1

I have a setup as below

source for kvpair:  Duration: {2297} | Kernel: {171} | User: {1218}

KVblock is as below

      kv {
        trim_value => " {}\r\n"
        trim_key => " \r\n"
        value_split => ":"
        field_split => "|"
        target => "perf"
        source => "kvpairs"
      }

I get all required fields to Kibana as below

perf.Duration   2297
perf.Kernel     171
perf.User       1218
perf.type       PerfExe

But all these fields are Strings.
Im specifically interested to convert "perf.Duration" to an integer

I learned from Google that below thing is not gonna work

mutate {
            convert => { 
                "perf.Duration" => "integer"
                #"Duration" => "integer" <-- Earlier tried this to make sure i dont miss the correct field 
            }
          }

Then I tried few ruby filters as below

      ruby {
          code => 'event.set("perf.Duration", event.get("perf.Duration").to_i)'
      }

Then this

      ruby {
          code => "
            hash = event.to_hash
            hash.each { |key,value|
              if key == 'Duration' 
                event.set(value, value.to_i)
              end
            }
          "
      }

They didn't work as well.

Can someone help me to get this fixed please.

2

In Kibana, if a field is an object that contains another field it would appear as perf.Duration. In logstash, a field where the name contains a period would be perf.Duration, but a perf object that contains a Duration field would be called [perf][Duration]

Also in logstash, in the configuration \r and \n do not refer to CR and NL unless you have config.support_escapes enables, but a lot of filters will just work around them, so you may not need to trim/strip them.

3

Thanks @Badger
Below code did the trick

      ruby {
      code => 'event.set("[perf][Duration]", event.get("[perf][Duration]").to_i)'
      }

meanwhile i have another issue

when i have

source for kvpair:  Duration: {2297} | Kernel: {171} | User: {1218}
and in a separate field
perf.type	PerfSproc

Im trying to do this

        if [perf.type] == "PerfSproc" { 
          mutate {
            rename => { "perf.Function" => "perf.Sproc"}
          } 
        }
        if [perf.type] == "PerfReplication" { 
          mutate {
            rename => { "perf.Function" => "perf.Sproc"}
          } 
        }
        if [perf.type] == "PerfExe" { 
          mutate {
            copy => { "hitachiprrogram" => "perf.exe"}
          } 
        }

And these does not work as expected
cant i use mutate plugin at all in these cases?

4

If [perf] is an object then these should be

rename => { "[perf][Function]" => "[perf][Sproc]"}
5

Thanks @Badger :star_struck::star_struck::star_struck:

6

Badger is King of Logstash :100:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.