Implement custom code in Filter plugin for Logstash

Elastic Stack Logstash
4

You can use mutate or ruby code, it's up to you

input {
  generator {
       message => "Test message"
	   count => 1
  }
}
filter {

   mutate {
     copy => { "message" => "msgmutate" }
   }
   mutate { 
     lowercase => [ "msgmutate" ]
   }

    ruby {
     code => "event.set('message', event.get('message').upcase )"
	}

    mutate { remove_field => [  "host", "log" ] }

}

output {
    stdout { }
}

Output:

{
         "event" => {
        "original" => "Test message",
        "sequence" => 0
    },
       "message" => "TEST MESSAGE",
     "msgmutate" => "test message"
}
1 Like