Need to use a if condition


(Lahiru Lakshitha Samaranayaka) #1

Hi I need to use a if condition in my application for example
"monitoredCIName" => "icdudautmutl23" if monitoredCINme is start with "icd" I need to add new field
how do I do that???

OS: CentOs
logstash Version 5.1.1
Example output:

"description" => "TEST - Metric Memory Usage = 18%",
"type" => "vdash_events",
"title" => "TEST - icdudautmutl23.pearsontc.com",
"raisedTimestamp" => "2017-01-12T22:33:05+0000",
"host" => "10.25.7.242",
"date_raised" => "2017-01-12",
"trigger" => "TEST - icdudautmutl23.pearsontc.com",
"tags" => [],
"@timestamp" => 2017-01-12T22:33:48.618Z,
"monitoredCIName" => "icdudautmutl23",
"category" => "Host"

I'm new to ELK BTW


(Magnus B├Ąck) #2
if [monitoredCINme] =~ /^icd/ {
  mutate {
    add_field => {
      "field name" => "field value"
    }
  }
}

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.