[SOLVED] Increment field value in logstash filter

Elastic Stack Logstash
1

Hello,
I have a data taken from the filter elasticsearch query.

elasticsearch {
hosts => ["localhost:9200"]
index => "elasticinput"
query => '_id=%{fingerprint}'
fields => { "request_ip_count" => "new_request_ip_count" }
fields => { "request_counter_attempts" => "new_request_counter_attempts" }
fields => { "request_domain_root" => "new_request_domain_root" }
}

The fields contains a number:
"request_ip_count":"3"

How can I increment this field by 1?
I want it to be: "request_ip_count":"4"

Is there a way?

2

How about

    ruby {
        code => '
            c = event.get("request_ip_count")
            if c
                event.set("request_ip_count", c.to_i + 1)
            end
        '
    }
3

Hey Badger,
my solution last week that I forgot to publish was:

if [request_ip_count] != "" {
ruby {
code => '
event.set("request_ip_count", event.get("request_ip_count").to_i + 1)
'
}
}

4

Thank you for your help as well!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.