Kv filter doubts

Elastic Stack Logstash
1

Upon filtering the fields in kvs, can if or any other conditional statemnts be used on the keys and values. If so, how?

2

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html

3

Hi Magnus but in the if statements how do you specify the keys/values as a condition

4

Let say the snippet is "error":"1" , "usrname:"tom" If i pass it across kv fliter i get all these four fields separately. Now i want to specify if the error is 1, then network is down, error is 2 sotware is out dated (just for an example); then how do i use the use if statemnt after writinga a kv filter

5

There are several examples of just that in the Conditionals section of the page I linked to.

6

For an enumeration such as your example you can use the translate filter.

7

if conditions works fine with the most. But if followed by a key , it doesnt work.

8

can if statments be used in the filter section but outside the mutate section.?

9

if conditions works fine with the most. But if followed by a key , it doesnt work.

I don't understand what you mean. Please always give examples instead of describing things with words.

can if statments be used in the filter section but outside the mutate section.?

Yes.

10

I tried to use else statement in filter section. It threwan error.

11

thanks

12

error reads as "Coudnt find any plug in named else"

13

error reads as "Coudnt find any plug in named else"

Then you used the wrong syntax, got your braces mixed up, or something else.

14

yes i have mixed up with double quotes

15

Hi Magnus

How do i make a search case insensitive.

For example, The input text is as follows : if statuscode=001 or StatusCode=001, StaTUSCode=001. I have to design a filter that can pick up any combination of statuscode irrrespective of its case.

16

Wouldn't the kv filter's transform_key option help?

17

When i used transform_key, i obtained the following error

Unknown setting 'transform_key' for kv {:level=>:error}
Error: Something is wrong with your configuration. {:level=>:error}

18

You need to upgrade your kv plugin. If your version of Logstash is too old you may have to upgrade Logstash as well.

19

is there a command to upgade kvplugin and logstash . Is the Upgrading kv plugin is different from upgrading logstash?

20

The Logstash documentation describes how to upgrade individual plugins.