Logstash - comparison 2 fields

Elastic Stack Logstash
1

Hello.
I would like to compare 2 fields using logstash.
To be more precise, i would like to know id the content of one field is included into the other one, using ( regex)

i tried this configuration

   if ( [test][field1] and [test][field2]){
     if ([test][field2] =~ /.*%{[test][field1]}/) {
       mutate {
         add_field => { "DiffRegexp" => "true" }
       }
     } 
   }

However, That 's not working.

Any help would be appreciated

Thanks !

2

No sprintf substitution is done on conditionals

    mutate { add_field => { "[a]" => "foo%{b}" } }
    mutate { add_field => { "[b]" => "bar" } }

    if "%{b}" in [a] { mutate { add_field => { "[c]" => "baz" } } }

will add the field [c]. You can use a ruby filter

    ruby {
        code => '
            a = event.get("a"); b = event.get("b")
            if a and b and a.include? b
                event.set("c", "baz")
            end
        '
    }
1 Like
3

Thank you @Badger , this is indeed the solution :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.