I have a logstash conf field A : Value A field B : Value B
———————————————————————————
I would like to become
The value of field A is equal to N/A, i will use the value of field B, as follows: field A : N/A -> field A : Value B
Can someone provide an approach?
Does this look like what you need?
Test Conf
input { generator { lines => ['[{"fielda": "N/A", "fieldb": "valueb"},{"fielda": "valuea", "fieldb": "valueb"}]'] count => 1 codec => "json" } } filter { if [fielda] == "N/A" { mutate { update => { "fielda" => "%{fieldb}" } } } } output { stdout { codec => json } }
Thanks a lot! it work
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.