Logstash if statement with regex example

Elastic Stack Logstash
1

Can anyone show me how an if statement with a regex look like in logstash?

my statement s
if [fieldname] =~ /^[0-9]$/
if [fieldname] =~ "^[0-9]$"
does not work

What I intend to do is to check if the "fieldname" contains an integer

2

This is the correct syntax:

if [fieldname] =~ /^[0-9]*$/
3

This does not work. I think the problem is the value of the field is e.g. 1 instead of "1"

How should I handle this?

4

Yes, regexp matches don't work on numbers. Perhaps you can just use normal inequality checks then? They won't be true unless the field is a number.

if [fieldname] >= 0 and [fieldname] < 2147483647  # or some other large number
1 Like
5

Tried this before. Got a page of error message.

6

In that case a Ruby filter might be the only way.

7

did a workaround in a not so elegant way.

I created a new field and appended a blank space to it and gsub to remove the blank space. This will make it into a string and work with the regex.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.