Remove left whitespaces logstash

Elastic Stack Logstash
1

Hi i have the following fields:
"delivery_quantity" : " \s\s\s\s4",
"numerator" : "\s\s\s1",
"denominator" : "\s\s\s1"
example_1

I've tried to use mutate split and gsub but didnt work.
I've seen that split works when you have for example:
"delivery_quantity" : "4 "
i,e, whitespaces from the right.

Any help please?

2

Both should work. Using

input { generator { count => 1 lines => [ '{ "a": "    1" }' ] codec => json } }

you could use either

mutate { gsub => [ "[a]", "\s+(\S)", "\1" ] }

or

mutate { split => { "a" => " " } }
mutate { replace => { "a" => "%{[a][0]}" } }

If you do not know which fields you need to adjust ahead of time then use ruby

    ruby {
        code => '
            event.to_hash.each { |k, v|
                if v =~ /^\s/
                    event.set(k, v.sub(/^\s+/, ""))
                end
            }
        '
    }
3 Likes
3

The mutate fiter has a setting called strip to remove leading and trailing spaces.

Just try to add this in your pipeline.

mutate {
    strip => ["numerator", "delivery_quantity"]
}
1 Like
4

I tried but I'm suppossing that this filter don't work with left whitespaces.
I've had a fields that had right whitespaces like:
example: "string\s\s\s\s" and the strip work just fine but in this case that I have
example: "\s\s\s\s string" don't work as expected.

5

It should work for both leading (on the left) and trailing (on the right) spaces.

Unless those are not spaces but other character like tabs, I'm not sure the filter works with tabs.

You could try to use a gsub to remove the tab character, just use \t.

I think it would be something like this:

mutate {
    gsub => ["fieldName", "\t", "" ]
}
6

The only thing that worked was the Ruby Code, thank you so much.

7

Do you know how to handle an expression,for example i have a field:
path: /string/string/string/string/file.txt

and i want to get only the last part, i.e, the file.txt.
the filter strip can help me?

8

See this thread.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.