How to create a filed based on a condition

(Vikas Gopal) #1

Hi Experts,

I want to create a filed (pri_caption) in logstash based on a condition i.e
addfield pri_caption {
if priority between 1 to 3 then "low"
else if priority between 4 to 7 then "medium"
elase High

Please suggest how I can achieve this ?


(Magnus Bäck) #2


filter {
  if [priority] >= 1 and [priority] <= 3 {
    mutate {
      add_field => ["pri_caption", "low"]

If there's an enumerable number of priorities you could also use the translate filter.

(Vikas Gopal) #3

Thanks Magnus,

May I achieve the same with scripted filed as well, I mean what if I do not want to do this in LS . What if I want to achieve this at the time of search in kibana ?


(Magnus Bäck) #4

You should be able to set up a scripted field for this. Lucene expressions support the ternary operator so if you just want "low", "medium", or "high" depending on the value of a numerical field it should be trivial.

(Vikas Gopal) #5

so I tried this but it does not work
doc['priority'].value == 9 ? high : low

(Magnus Bäck) #6

You'll have to double-quote the strings, but glancing at the docs I'm not sure strings are supported in Lucene expressions. You may have to enable Groovy scripts, but I'm out of my depth here.

(system) #7