Identifying fields using sprintf

Elastic Stack Logstash
1

I have some JSON data coming to me over HTTP. Each record has a field that needs to be converted to an integer but its name will vary, e.g. "fieldA_count" in one record and "fieldfB_count" in another. Each record contains another identifying field named "field_name" with a value "fieldA" or "fieldB". I want to use the identifying field to name the field I need to convert to an integer, i.e.

mutate{
    convert => { "%{field_name}_count => "integer" }
}

I'd like this evaluated to:

mutate{
    convert => { "fieldA_count => "integer" }
}

...or:

mutate{
    convert => { "fieldB_count => "integer" }
}

But when I tried this the fields remained Strings. What am I doing wrong?

Craig

2

Yeah, the name of the field to convert isn't subject to sprintf expansion. This is already reported in issue #57. Until that's fixed you can use a ruby filter.

3

Thanks Magnus, do you think this would work? (I'm pretty new at Ruby)

field_prefix = event['prefix']
field_name = field_prefix + '_count'
event[field_name] = event[field_name].to_i
4

Why not just try it out? But yeah, it looks good

5

Just lazy I guess :wink: I did try it and it worked, thanks for the help.