Replacement across all fields with single rule

Elastic Stack Logstash
1

I have around 40 fields of numeric data in csv format and occasionally multiple fields in a row could be invalid values (indicated with, say, hyphen -).

In the logstash is there a way to define a single generic mutate rule that works on all the fields to convert the hyphen (-) into numeric zero (0).

Right now, I have to have mutate rule once for each field, which is not really good way. For example,

csv {  columns => [ col1, col2, col3, .... col40 ]    }
mutate {
gsub => [
    "col1", "-", 0,
    "col2", "- ", 0,
     ....
   ]
 }
}

Is there a much better simpler way to achieve this than to manually specify the same rule 40 times?

2

You'd have to use a ruby filter. Untested example:

filter {
  ruby {
    code => '
      event.to_hash.each { |k, v|
        event[k] = 0 if v == "-"
      }
    '
  }
}
3

Thanks @magnusbaeck I am not familiar with Ruby. Will try to look into it.