This event is posted as JSON to Logstash using the http input plugin.
The output is stdout with rubydebug codec.
This is what I am trying to achieve:
If the device number in the [device] field is less than 33(device_32, device_26 etc), I want to add a field "set" with value "set1".
Else, I want to add "set" with value "set2".
In either case, I want to add a field "rule_matched" with value 'device number'.
So in the above example, I want to add "set":"set2", "rule_matched":"53"
The challenge is I am not understanding how to get the number from the [device] field and use it in conditionals and to set the rule_matched value.
However, I realized after posting the question that I do not want to keep the rule_matched field in the final output. That is the reason I tried to use the @metadata field. But the problem is that Logstash crashes everytime I try to convert [@metadata][device_num] to an integer. This introduces an extra step of deleting the rule_matched field manually after it has been used in conditionals.
Is there a reason for this behavior or is it a bug?
Oh and also, I would like to know, from a standards point of view, is it better to use grok for this use case or is my method (well, not mine) good enough?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.