{"name": "hello", "xy": "ab", "ip": "123.456.78.910", "abc": "AB", "nbc": 12345, "cidr": "123.456.78.9/10",
"last_seen_at": "2017-08-15", "first_seen_at": "2015-09-03", "categories": ["hello"]}
I have an array of numbers for the field "nbc" which i need to filter out from my log files. rest everything i need to drop. since my log file is in JSON, i've been just forwarding as is. Can someone please guide me on how to approach this problem?. I can easily grep these numbers from a shell script but I want logstash to handle this due to some logistic reasons in our pipeline. Any help is appreciated.
Adding my logstash config.
input {
file {
path => "/path/to/file/*.json"
start_position => "beginning"
add_field => { "provider" => "xyz" }
type => "abc"
codec => "json"
}
}
filter {
if [provider] == "xyz" and [type] == "abc" {
if ["nbc"] !== "1234" OR ["nbc"] !== "4567" OR ["nbc"] !== "8910" {
drop { }
}
Thanks.