Currently I am doing something like this in my logstash config file :
filter {
...
mutate {
...
convert => {
"blahId" => "integer"
"blahblahId" => "integer"
...
...
"b...blahId" => "integer"
}
...
}
...
}
So basically I want to convert all the fields ending with "Id" to type integer. Is there a way to do that in one line? Something like "*Id" => "integer"
which does that ?
Edit : I tried
convert => {
"*Id" => "integer"
}
As I expected, didn't work.
Using ruby filter perhaps ?
Not specifically an answer to this but this is what I end up doing :
ruby {
code => "
fieldArray = event['kvmess'].split('|');
for field in fieldArray
name = field.split('=')[0];
value = field.split('=')[1];
if value =~ /\A\d+\Z/
event[name] = value.to_i
else
event[name] = value
end
end
"
}
My kvmess
was like "blahId=123|blahblahId=456|some=thing|b..blahId=789".
So this converted all keys having numeric values to type integer.
There is a plugin - kv meant specifically for this but it does not have the functionality to change datatype to int so I ended up using this ruby plugin instead.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With