I have the following the json message. { "eventData" : { "commandContext" : { "eventUserId" : "system", "eventOrigin" : "java", "eventQueueMgr" : "TEST1", "eventAccountingToken" : 0000000000000000000000000000000000000000000000000000000000000000, "eventApplIdentity" : "", "eventApplType…

[image] paano: [eventData][commandContext][eventAccountingToken] The JSON has not been parsed when the ruby filter executes, so that field does not exist at that point. You can remove leading zeroes from fields using mutate { gsub => [ "message", " 0*([0-9]+),", " \1," ] }

Discuss the Elastic Stack

Trying to add ruby filter to remove leading zero

Elastic Stack Logstash

Badger February 18, 2019, 10:23pm 4

ruby { code => ' event.set("message", event.get("message").gsub(/ 0*([0-9]+),/, " \\1,")) ' }

LogStash::Json::ParserError: Invalid numeric value: Leading zeroes not allowed

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.