How to prevent clobbering in translate filter

Elastic Stack Logstash
4

I suspect not. You could convert the flag to binary

ruby {
    code => '
        flag = event.get("Flag")
        if flag {
            event.set("[@metadata][flags]", flag.to_i.to_s(2))
        }
    '
}

then use grok to pick out each bit and test it. However, it might be easier to just do the whole thing in ruby.

    ruby {
        code => '
            flag = event.get("Flag").to_i
            flags = []
            if 0 != flag & 4 ;   flags << "Machine lost service" ; end
            if 0 != flag & 16;   flags << "liveness test timed out" ; end
            if 0 != flag & 64;   flags << "service failed liveness check in last 30 sec" ; end
            if 0 != flag & 512;  flags << "stopped" ; end
            if 0 != flag & 2048; flags << "lost certs" ; end
            event.set("Flag_Definition", flags)
        '
    }
1 Like