Mutate Replace not working properly in ELK STACK 7.2 Looks there a bunch of bug of this verion

Elastic Stack Logstash
1

Hi All,

Tried these in my logstash filtering.

  filter {
    if [geoip.region_name] == "Guangxi" {
     mutate {
      replace => [ "geoip.region_name", "Guangxi Zhuang Autonomous Region" ]
     }
    }

    if [geoip.region_name] == "Inner Mongolia Autonomous Region" {
     mutate {
      replace => ["geoip.region_name", "Inner Mongolia" ]
     }
    }
}

To replace the "Guangxi" to "Guangxi Zhuang Autonomous Region" and "Inner Mongolia Autonomous Region" to "Inner Mongolia", to work on vector map of China province. However it never changed the output as expected and still the same.

But logstash check was "Configuration OK"

Same thing here in my previous posted.

2

That refers to a field with a dot in its name, a geoip is an object with fields inside it. Use [geoip][region_name]

3

@Badger,

Great! It works perfectly as my expected. Thank you very much for your helped.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.