I want to replace the value of a field if its value is a certain number

Elastic Stack Logstash
1

I want to replace the value of a field if its value is a certain number and I'm not sure what I'm doing wrong.

Here is the input:

            "price" => 811950,
"last_price_update" => "2019-12-22T11:30:23Z",
             "name" => "Mastela Fruit",
             **"type" => 8,**
       "@timestamp" => 2019-12-23T10:41:16.525Z,
         "@version" => "1"

}
{
"price" => 159252,
"last_price_update" => "2019-12-22T11:35:24Z",
"name" => "Seed of Mastela",
"type" => 11,
"@timestamp" => 2019-12-23T10:41:16.525Z,
"@version" => "1"
}

I have tried:

filter {
json {
source => "message"
}
mutate {
add_field => { "price" => "%{[sea][latest]}" }
add_field => { "last_price_update" => "%{[sea][latest_time]}" }
remove_field => [ "global", "image", "global_sea_diff", "sea" ]
}
mutate {
convert => { "price" => "integer" }
convert => { "type" => "integer" }
}
if [type] == "8" {
mutate { replace => { "type" => "materials" } } }
else {
mutate { replace => { "type" => "others" } } }
}

I also tried:

filter {
json {
source => "message"
}
mutate {
add_field => { "price" => "%{[sea][latest]}" }
add_field => { "last_price_update" => "%{[sea][latest_time]}" }
remove_field => [ "global", "image", "global_sea_diff", "sea" ]
}
mutate {
convert => { "price" => "integer" }
convert => { "type" => "integer" }
}
if "8" in [type] {
mutate { replace => { "type" => "materials" } } }
else {
mutate { replace => { "type" => "others" } } }
}

Both don't work. Here is the result:
{
"@version" => "1",
"name" => "Mastela Fruit",
"price" => 811950,
"type" => "others",
"@timestamp" => 2019-12-23T10:52:29.300Z,
"last_price_update" => "2019-12-22T11:30:23Z"
}
{
"@version" => "1",
"name" => "Seed of Mastela",
"price" => 159252,
"type" => "others",
"@timestamp" => 2019-12-23T10:52:29.301Z,
"last_price_update" => "2019-12-22T11:35:24Z"
}

the price doesn't appear to be turning to integer as well

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.