如何在logstash中创建条件字段？

Question

I have a field called "Priority" which has integer values like 1 to 10. Here 1 is the lowest and 10 is the highest. How to show string values, rather than, numbers to make this field more understandable. So new field should contain 3 values ie

low ---> if priority lies in 1 to 3
Medium---> if priority lies in 4-7
high---->if priority lies in 8-10

Answer 1

First of all, you need to assure that your priority value is of type int . After that you can use logstash's conditionals to change the value into a string.

Example Configuration:

input { stdin {} }
filter {
    grok { match => { "message" => [" %{NUMBER:priority:int}" ] } }
    if [priority] < 4 {
        mutate { replace => { "priority" => "low" } } 
    } else if [priority] < 8 {
        mutate { replace => { "priority" => "medium" } }
    } else {
        mutate { replace => { "priority" => "high" } }
    }
}
output {stdout { codec => rubydebug }}

Please note the grok filter which parses your number into a field of type int .

%{NUMBER:priority:int}

That means, wherever you get your priority field from, you need to take care that it contains an int. Otherwise you could do this by comparing string values.

Answer 2

I would suggest that you keep two fields: both the numeric and the string (pretty) version. That way, you can run efficient queries based on the number and display the string on your charts, etc.

More info here .