Logstash condition to check if a field value starts with another field's value

Elastic Stack Logstash
#1

Hi,

I'd like to know how I can check in an if-condition in Logstash, is a field's value (in the example below the field is named "complete") starts with the value of another field (in the example below the field is named "starts_with").

I tried

if [complete] =~ /^[starts_with].*/ {
    ...
}

This sounds like a simple task, but maybe it's just too late for me. Do you have a syntax hint?

Best regards, Mattin

#2

I do not think there is a way to do that with a conditional. You may need to resort to ruby

ruby { code => 'event.set("[@metadata][testThis]", event.get("complete").start_with? (event.get("starts_with")))' }
if [@metadata][testThis] {
    ...
2 Likes
#3

Thanks, that's a pity that one needs ruby for such a simple task.
But at least it explains why I couldn't get it working without ruby :smiley:

Best regards, Mattin