Hi, after doing the split filter, so my message was an array ok, so %{[message][0]} %{[message][1]} ... that gives me their value fine. now I have an array of length 30 for example and I start the condition if {} example logstash.conf: filter { mutate { split => {"message" => "|"} } mutate { …

Initialize counter in logstash and replace the '%{[message][0]}'?

system (system) Closed June 14, 2022, 4:28pm 11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Add a counter field to each message Logstash	1	425	July 6, 2017
Iteration in Logstash Logstash	5	14211	July 6, 2017
Logstash Question Logstash	3	371	May 19, 2017
Find and replace string in [message] field Logstash	9	4877	September 14, 2017
[SOLVED] Increment field value in logstash filter Logstash	4	2368	March 4, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Initialize counter in logstash and replace the '%{[message][0]}'?

Related topics