logstash - remove all non digit characters from field -


i have log files passing logstash modified before pushing elasticsearch.

one of fields have appears series of digits

foobar = 42 

sometimes prefixed letters

foobar = ws-42 

i want make sure field integer, , if non-digits present, removed.

here part of logstash config makes sure field integer

filter {   mutate {     convert => [ "foobar", "integer"]   } } 

how can strip out characters if present?

update

by using mutate filter can either strip out non numerical values, or can convert integers. if try , both, returns 0.

example

input {   stdin {} }  filter {   kv { }   mutate {     gsub => [ "foobar", "\d", "" ]     convert => [ "foobar", "integer" ]   } } 

here output. notice if '42' provided, foobar returns integer of 42, if provide 'sw-42' foobar returns 0

foobar="42" {        "message" => "foobar=\"42\"",       "@version" => "1",     "@timestamp" => "2015-03-31t22:32:11.718z",           "host" => "swat-logstash02",         "foobar" => 42 } foobar="sw-42" {        "message" => "foobar=\"sw-42\"",       "@version" => "1",     "@timestamp" => "2015-03-31t22:32:23.822z",           "host" => "swat-logstash02",         "foobar" => 0 } 

it's scoping issue.

if gsub (without convert), shows regexp working:

{        "message" => "foobar=\"sw-42\"",       "@version" => "1",     "@timestamp" => "2015-03-31t22:42:40.097z",           "host" => "0.0.0.0",         "foobar" => "42" } 

so should run 2 stanzas:

filter {   kv { }   mutate {     gsub => [ "foobar", "\d", "" ]   }   mutate {     convert => [ "foobar", "integer" ]   } } 

Comments

Popular posts from this blog

cakephp - simple blog with croogo -

How to group boxplot outliers in gnuplot -

bash - Performing variable substitution in a string -