Update field value if it matches a certain word

[naveenrt23 (naveen)]

Hello,

I am trying to replace the value of a field if the field value matches with a certain regex. I am looking at the update function in mutate filter.

output:
  "repo" => "test-xyz;buildNumber=2.1",

how do i set a mutate filter on this such that

if "repo" value starts with "test-xyz;" , set value for repo as "test-internal"

if [repo] = "test-xyz; .*"{

update => 'test-internal'

}

[Badger]

You should use =~ rather than =, and remove the space from the regexp. You can use mutate+replace to replace the value of a field.

[naveenrt23 (naveen)]

if [repo] =~ "test-xyz;.*"{
      filter {
            mutate {
              replace => { "repo" => "test-internal" }
            }
          }
      }

Is this the right syntax ?

I get a syntax error when i tried the above

[2019-09-26T15:46:19,838][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Expected one of #, => at line 45, column 20

[Badger]

No, the conditional has to be inside the filter

filter {
    if [repo] =~ "test-xyz;.*" {
        mutate {
          replace => { "repo" => "test-internal" }
        }
    }
}