Logstash, converting fields


i want to make some converts in my .log files, for example converting kilometer to meter.

how can i do this?

We don’t have a math filter yet. You will need to use a ruby filter.

Thnx, With ruby, can i make all converts that i need?

yes. This should work. Just change the [somefield]. If your field is called distance then it should be [distance]. If your field is a nested field then it should be [parent][distance] with any number of [][][] groups to correctly reference the field nesting.

  ruby {
    init => '
      KILOMETER_FIELD_REF = "[somefield]"
    code => '
      kilometers = event.get(KILOMETER_FIELD_REF).to_f
      event.set(KILOMETER_FIELD_REF, (kilometers * 1000).round.to_i )

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.