logstash - remove all non digit characters from field -
i have log files passing logstash modified before pushing elasticsearch.
one of fields have appears series of digits
foobar = 42 sometimes prefixed letters
foobar = ws-42 i want make sure field integer, , if non-digits present, removed.
here part of logstash config makes sure field integer
filter { mutate { convert => [ "foobar", "integer"] } } how can strip out characters if present?
update
by using mutate filter can either strip out non numerical values, or can convert integers. if try , both, returns 0.
example
input { stdin {} } filter { kv { } mutate { gsub => [ "foobar", "\d", "" ] convert => [ "foobar", "integer" ] } } here output. notice if '42' provided, foobar returns integer of 42, if provide 'sw-42' foobar returns 0
foobar="42" { "message" => "foobar=\"42\"", "@version" => "1", "@timestamp" => "2015-03-31t22:32:11.718z", "host" => "swat-logstash02", "foobar" => 42 } foobar="sw-42" { "message" => "foobar=\"sw-42\"", "@version" => "1", "@timestamp" => "2015-03-31t22:32:23.822z", "host" => "swat-logstash02", "foobar" => 0 }
it's scoping issue.
if gsub (without convert), shows regexp working:
{ "message" => "foobar=\"sw-42\"", "@version" => "1", "@timestamp" => "2015-03-31t22:42:40.097z", "host" => "0.0.0.0", "foobar" => "42" } so should run 2 stanzas:
filter { kv { } mutate { gsub => [ "foobar", "\d", "" ] } mutate { convert => [ "foobar", "integer" ] } }
Comments
Post a Comment