Logstash filter help pleas

Elastic Stack Logstash
1

Hi

I'm in the process of trying to migrate my config from 6.7 to 8.x
I have found I have to rewrite my logstash rules - okay probably a good time to do that.
On that note - my filebeat 6.7 client worked fine, when i upgraded my client o 8.4 it started to fail - but all good.

what I would like some help on is

I base the index on the host name I have env dev1 dev2 dev3 etc. each inv has app1 app3 app5 db jmp rp so dev1app1 dev1app3 etc etc .

so i have a if then else with lots of else if basically doing this

if [host][name] =~ "^dev10" {
        mutate {
          add_field => { "env" => "dev10" }
        }
      } else if [host][name]=~ "^dev11" {
....

I was thinking it would be better if I can regex out the env from the hostname
with something like

grok {
    match => {
      [host][name]  => "^(?<env>)(app|geode|rp|db|jmp)"
    }
  }

But that doesn't work

help please

2

Based on this code part :

It seems you just do a copy of the host.name field into the env field.
So you can use the copy option of the mutate filter

mutate {
    copy {
        copy => { "[host][name]" => "env" }
    }
}

But if your host.name can contain dev1app3 and you just want the dev1 part so grok is not a bad solution :

grok {
    match => {
      [host][name]  => "(?<env>dev%{NUMBER})"
    }
}

Cad.

3

Yes the bottom one makes sense

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.