Remove first and last character of all fields

Elastic Stack Logstash
1

Hi,

I would like to replace the first and last character of all values in all fields ingested into my index via logstash? Please could you let me know how this is possible?

I understand this may be a ruby task but please let me know.

Thanks

2

I did try the below code too but does not seem to work I get a ruby exception occurred undefined method `' for nil:NilClass:

ruby {
code => "
hash = event.to_hash
hash.each { |k,v|
event.set(k, event.get(v)[1..-1])
}
"
}

3

I don't think you need the event.get, you can just use v to refer to the value of a field.

4

Using event.set(k, v[1..-1]) instead but i get undefined method ` ' for logstash::timestamp

Any ideas?

5

Yeah, that seems reasonable, since you cannot refer to a LogStash::Timestamp as an array. If you want to remove the first and last characters of every string field you could try

code => '
    event.to_hash.each { |k, v|
        if v.is_a? String
            event.set(k, v[1,-2])
        end
    }
'
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.