Using replace in Logstash

Elastic Stack Logstash
1

if [score] >= "35"

mutate
replace => [ "score","Success" ]

my error is if score Greater than equal to 35 value considered as success so im displaying graph in success, but it only shows 35 to 99 values in label name of success and above 99 three digit values cant be changed to label of success name
it shows like this
123
101
156
actual output is instead of values consider as success

2

Is [score] a string in logstash? If it is an integer then that should be

if [score] >= 35

without the quotes. I think >= will do unexpected things if it is a string.

3

Without quotation file cant be readed and i get output from below code but the label cant be matched to all values it match only two digit values

if [score] >= "35"
mutate
replace => [ "score","Success" ]

my data is
score
36
45
100
120
but it can taken only two digit values to replaced success and three digit values directly printed like this
100
120

help me

4

It is not doing a numeric compare. Consider

input { generator { count => 1 lines => [ '36', '45', '100', '120', '349', '351' ] } }
filter {
    if [message] >= "35" {
        mutate { add_field => { "branch" => true } }
    } else {
        mutate { add_field => { "branch" => false } }
    }
}
output { stdout { codec => rubydebug { metadata => false } } }

That results in

{
    "@timestamp" => 2020-01-23T17:57:37.288Z,
        "branch" => "true",
       "message" => "36"
}
{
    "@timestamp" => 2020-01-23T17:57:37.296Z,
        "branch" => "true",
       "message" => "45"
}
{
    "@timestamp" => 2020-01-23T17:57:37.297Z,
        "branch" => "true",
       "message" => "351"
}
{
    "@timestamp" => 2020-01-23T17:57:37.296Z,
        "branch" => "false",
       "message" => "100"
}
{
    "@timestamp" => 2020-01-23T17:57:37.297Z,
        "branch" => "false",
       "message" => "120"
}
{
    "@timestamp" => 2020-01-23T17:57:37.297Z,
        "branch" => "false",
       "message" => "349"
}

If however we change that if to be

    mutate { convert => { "message" => integer } }
    if [message] >= 35 {

then they all go through the "true" branch.

If you put these 6 numbers into a text file and sort it using "sort" it you will get

100
28
349
35
351
36

that reflects the order that your if is evaluating. Obviously "sort -n" returns a different order.

5

Hi Badger,
im using above code but it cant be read the file
and the error msg following like this

Error parsing json {:source =>"message" ,:raw =>"1576978110000 /t 78 /t 35 /r" was Expecting (true,false or null)

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.