Logstash filter with regex

Elastic Stack Logstash
1

We are using following filter condition to distinguish if the value of a field is a string or an object:

  if [log][outgoing_message][body] =~ /.*/ {
    mutate {
       rename => ["[log][outgoing_message][body]", "[log][outgoing_message][body_text]"]
    }
  }

Is works pretty good, unless the value of the field is a number. in such case, the number does not met the regular expression and the field is not renamed. This leads to mapping issues at the end.
e.g.
log.outgoing_message.body: 95456789

Is this a correct behavior of the logstash filter ?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.