Range Filter

Elastic Stack Logstash
1

With the Logstash range filter, is it possible to use a wildcard to target all similarly name fields? For example, instead of listing out all the event_data fields one by one, I want to target all of them - something like event_data.*

Also, does the range filter drop the entire event, or just the targeted number of characters?

filter {
range {
ranges => [ "[event_data][param12]", 256, 1e1000, "drop",
"[event_data][param12]", 256, 1e1000, "tag:long"]

2

No, you cannot use wildcards. It drops the entire event if the action is drop.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.