Logstash, converting fields

Elastic Stack Logstash
1

Hello
i want to make some converts in my .log files, for example converting kilometer to meter.
how can i do this?

2

We don't have a math filter yet. You will need to use a ruby filter.

3

Thnx, With ruby, can i make all converts that i need?

4

yes. This should work. Just change the [somefield]. If your field is called distance then it should be [distance]. If your field is a nested field then it should be [parent][distance] with any number of [][][] groups to correctly reference the field nesting.

  ruby {
    init => '
      KILOMETER_FIELD_REF = "[somefield]"
    '
    code => '
      kilometers = event.get(KILOMETER_FIELD_REF).to_f
      event.set(KILOMETER_FIELD_REF, (kilometers * 1000).round.to_i )
    '
  }
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.