# Need to split a field and use part of it in conditionals

**URL:** <https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917>\
**Category:** Logstash\
**Created:** [October 5, 2017, 9:18pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917 "2017-10-05T21:18:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikas1590](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas1590/32/44423_2.png) [@vikas1590](https://discuss.elastic.co/u/vikas1590)\
**Post date:** [October 5, 2017, 9:18pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917/1 "2017-10-05T21:18:10Z")

</div>

I have an event with fields like:

> "description" =\> "The description\_53",  
> "network" =\> "network\_b",  
> "duration" =\> 600,  
> "start\_time" =\> "1493596800",  
> "node" =\> "node\_b",  
> "device" =\> "device\_53"

This event is posted as JSON to Logstash using the http input plugin.  
The output is stdout with rubydebug codec.

This is what I am trying to achieve:  
If the device number in the [device] field is less than 33(device\_32, device\_26 etc), I want to add a field "set" with value "set1".  
Else, I want to add "set" with value "set2".  
In either case, I want to add a field "rule\_matched" with value '_device number_'.  
So in the above example, I want to add "set":"set2", "rule\_matched":"53"

The challenge is I am not understanding how to get the number from the [device] field and use it in conditionals and to set the rule\_matched value.

Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 5, 2017, 11:33pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917/2 "2017-10-05T23:33:01Z")

</div>

You could do a grok on that `device` field, where the pattern is `device_%{NUMBER:id}` and then use that field.

---

<div class="post-metadata">

**Author:** ![vikas1590](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas1590/32/44423_2.png) [@vikas1590](https://discuss.elastic.co/u/vikas1590)\
**Post date:** [October 6, 2017, 8:11pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917/3 "2017-10-06T20:11:00Z")

</div>

Thanks for your response @warkolm. Appreciate it.

But I found out another way to tackle it soon after I have posted the question.

```
filter {
    mutate {
        add_field => {"[@metadata][device_num]" => "%{device}"}
    }
    mutate {
        gsub => ["[@metadata][device_num]", "device_",""]
    }
    mutate {
        add_field => {"rule_matched" => "%{[@metadata][device_num]}"}
    }
    mutate {
        convert => {"rule_matched" => "integer"}
    }
.
. some conditionals using the rule matched field
.
}

```

However, I realized after posting the question that I do not want to keep the `rule_matched` field in the final output. That is the reason I tried to use the `@metadata` field. But the problem is that Logstash crashes everytime I try to convert `[@metadata][device_num]` to an `integer`. This introduces an extra step of deleting the `rule_matched` field manually after it has been used in conditionals.

Is there a reason for this behavior or is it a bug?

Oh and also, I would like to know, from a standards point of view, is it better to use grok for this use case or is my method (well, [not mine](https://stackoverflow.com/a/38914786/2695332)) good enough?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 6, 2017, 8:42pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917/4 "2017-10-06T20:42:13Z")

</div>

I haven't seen that crash, but perhaps if you provide more info we can debug it.

Gsub can be expensive if used a lot.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2017, 8:43pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-and-use-part-of-it-in-conditionals/102917/5 "2017-11-03T20:43:31Z")

</div>

Closed on November 3, 2017, 8:43pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.