Logstash filter if statement when detecting multiple whitespace in middle of string

Elastic Stack Logstash
1

Hey all. I'm working on a Logstash pipeline that includes processing addresses.

Here's what my sample data might look like:

" 123 ABC Street"
"456 XYZ Street (a bunch of whitespaces here) PO Box 789"

The problem is if there's a PO Box I want that giant of whitespace to be taken out. I've already written a filter to accomplish this:
'''

grok {
match => [
"address", "(%{DATA:address1} %{SPACE} %{DATA:address2})"
]
}
mutate {
replace => { "address" => "%{address1} "%{address2}" }
}
}
'''
However, I want to add an if statement to these filters so that the filter only runs if a large white is detected in the middle of the string. I'm not finding much documentation on how to structure conditionals so any help would be appreciated.

2

How about

mutate { gsub => [ "address", "\s+", " " ] }

which will replace multiple whitespace characters with one space?

1 Like
3

Or you check does 2 or more space/tabs exist:

   if ([address] =~ /[\s]{2,}/ ) {
     grok {match => [ "address", "(%{DATA:address1} %{SPACE} %{GREEDYDATA:address2})" ] }
   }
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.