How to create a filed based on a condition

Elastic Stack Logstash
1

Hi Experts,

I want to create a filed (pri_caption) in logstash based on a condition i.e
addfield pri_caption {
if priority between 1 to 3 then "low"
else if priority between 4 to 7 then "medium"
elase High
}

Please suggest how I can achieve this ?

Thanks
VG

2

Example:

filter {
  if [priority] >= 1 and [priority] <= 3 {
    mutate {
      add_field => ["pri_caption", "low"]
    }
  }
}

If there's an enumerable number of priorities you could also use the translate filter.

3

Thanks Magnus,

May I achieve the same with scripted filed as well, I mean what if I do not want to do this in LS . What if I want to achieve this at the time of search in kibana ?

Thanks
VG

4

You should be able to set up a scripted field for this. Lucene expressions support the ternary operator so if you just want "low", "medium", or "high" depending on the value of a numerical field it should be trivial.

5

so I tried this but it does not work
doc['priority'].value == 9 ? high : low

6

You'll have to double-quote the strings, but glancing at the docs I'm not sure strings are supported in Lucene expressions. You may have to enable Groovy scripts, but I'm out of my depth here.