Hi
How I can shift some fields with value in "if" condition
for example: CLLI, SWREL for the output in one event?
expected output:
{
"NDCFLXDA" => "0",
"@version" => "1",
"NDCFLXDC" => "0",
"STATUS" => "K",
"NMDCLFLR" => "0",
"@timestamp" => 2023-02-24T13:24:14Z,
"SUSRECVD" => "0",
"NEARMGIH" => "0",
"LINK" => "B ",
"NDCLFALP" => "0",
"DRLKINHB" => "0",
"FARMGINH" => "0",
"NDCFLABN" => "0",
"path" => "/opt/data/input/new_test1.csv",
"DRDCLFLR" => "0",
"DRFEPRO" => "0",
"NDCFLXER" => "0",
"NMFEPRO" => "0",
"SUSTRAN" => "0",
"PCRN1N2EXC" => "0",
"NDCLFSYNC" => "0",
"NMLCLPRO" => "0",
"DRLCLPRO" => "0",
"LSN" => "hlr91ip",
"SURCVERR" => "0",
"host" => "0.0.0.0",
"LOC" => "1211",
"LNKTYPE" => "IPVL",
"NDCLFINTR" => "0",
"message" => "K,hlr91ip,1211,B ,IPVL,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"
"CLLI" => "H91"
"SWREL" => "SW03"
}
below part of code:
input {
file {
mode => read
path => "/opt/data/input/new_test1.csv"
sincedb_path => "/dev/null"
start_position => beginning
file_completed_action => "log"
file_completed_log_path => "/opt/data/logstash_files/fin_eir.log"
}
}
filter{
if [message] =~ /^$/ { drop {} }
ruby { code => 'event.set("[@metadata][fields]", 1 + event.get("message").count(","))'
}
if [@metadata][fields] == 11 {
csv {
separator => ","
columns => ["CLLI","SWREL","RPTDATE","RPTIME","TZ","RPTTYPE","RPTPD","IVALDATE","IVALSTART","IVALEND","NUMENTIDS"]
skip_empty_columns => true
skip_header => true
}
ruby {
code => "
event.set('event_timestamp', event.get('RPTDATE') + ' ' + event.get('RPTIME'))
"
}
date {
match => ["event_timestamp", "MM dd yyyy HH:mm:ss", "yyyy-MM-dd HH:mm:ss", "MM dd yyyy HH:mm:ss", "ISO8601"]
timezone => "Europe/Paris"
target => "@timestamp"
}
ruby { code => '@@metadata = event.get("@timestamp")' }
drop {}
mutate {
remove_field => ["RPTDATE","RPTIME","RPTTYPE","RPTPD","NUMENTIDS","message","IVALEND"]
}
} else {
csv {
separator => ","
autodetect_column_names => true
}
ruby { code => 'event.set("@timestamp", @@metadata)' }
}
}
output {
stdout { codec => rubydebug }
}