1

In logstash filtering, I have multiple tags setup based upon different error conditions and all the tags has a prefix, something like "abc:"

In the output, I want to send email based upon just "abc:*" exists in tags.

I haven't come across such condition reading the docs.

Mostly it says:

if "abc" in [tags] { ... ... }

However I want to have the condition match any tag with "abc-*". Any ideas?

2 Answers 2

1

Are you looking for this (here in perl syntax)?

s/if\s*\"([^\"]*)\"\s*in\s*\[tags\].*/$1:/g;

If abc is a word you can use \w instead of [^\"].

0

@sudobash ok updating my previous comment, it was not the solution but rather a question. I know it's been a long time since this question was asked, but here is the solution in case someone needs it in the future:


If you hover your mouse on the "tags" field, you will see that it is supposed to be a "String" field, which is not true and here is how you can confirm it: According to the official Elasticsearch documentation, you can use the following conditions when filtering:

equality: ==, !=, <, >, <=, >=
regexp: =~, !~ (checks a pattern on the right against a string value on the left)
inclusion: in, not in

If you pay attention, you will see that you should be able to use "regexp" for String comparison, but why it doesn't work for "tags"? Well, the answer is because "tags" is not an String field, it is an "Array" field/object so any comparison must point to specific positions of the array.

If for example, you use this filter in your Logstash pipeline:

filter {
  if [tags][0] =~ /foo.*/ {
     mutate { add_tag => "worked" }
  }
}

it will work as expected, in the above example, if the position [0] of "tags" matches the regex condition "foo.*", a new value ("worked") will be added to the array of tags.

Now, I understand that in a real life scenario, this will not be useful, because you probably don't know the position in the array of the tag that you want to compare, right? So, out of the box, there is no way to accomplish this, you will have to use a ruby filter to do so. Refer to this post.

Here is a basic ruby filter, that will do exactly what I did in the previous filter example, but this time, it will do it dynamically:

filter {
  ruby {
    code => '
        mbool = 0
        event.get("tags").each_index { |x|
          if event.get("tags")[x] =~ /foo.*/
            mbool = 1
          end
        }
        if mbool == 1
          event.tag("ruby-worked")
        end
    '
}

Of course, it depends of what you want to accomplish at the end, but I'm pretty sure this post will be helpful.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .