How to get the value of fields that not string type

Elastic Stack Logstash
1

I want to add a non-string type field A( long type or json type) to logstash output, and set it's value by another field B .
so i need to access the value of B.
almost all examples related to accessing field value are nested in a string as:
" the longitude is %{[geoip][location][0]}"

i want to get field value in it's original type, like json,

add_field => [ "location2", [geoip][location] ]
or
add_field => [ "location2", %{[geoip][location]} ]

but pase error.
so what is the correct method?

2

i want to get field value in it's original type, like json,

JSON isn't a data type but I get what you mean.

This is a limitation in Logstash's configuration language but you can use a ruby filter to work around it.

event.set('location', event.get('[geoip][location]'))

But in this particular case, do you really want to keep the original field (and duplicate the location data)? If not then perhaps the mutate filter's rename option is what you're really looking for.

1 Like
3

thank you for quick reply
because in my log file, there are already country/city/region fields that thought more accuracy, so i need only lon_lat fields in geoip
rename option is very helpful
I have another question: is there any significant difference between mutate filter rename option and ruby filter in effeciency？
thank you!

4

is there any significant difference between mutate filter rename option and ruby filter in effeciency？

Probably not, but if that difference is important to you you should measure it.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.