Search code examples
logstashlogstash-groklogstash-configuration

Match multiple field names in logstash mutate filter

I would like to convert all metrics* fields into floats for logstash. For a structure like

{
  "metric1":"1",
  "metric2":"2"
}

I'd like to do something like

mutate {
   convert => {"metric*" => "float" }
}

Is that possible?

Solution

  • It's not possible without using a ruby filter like this:

      ruby {
    code => "
      event.to_hash.keys.each { |k|
        if k.start_with?('metric') and event[k].is_a?(String)
          event[k] = event[k].to_float
        end
     }
   "
  }

    So basically look at all of the keys in the event, and if they start with metric, covert them to a float. The is_a?(String) is there just in case you get an array field (because .to_float won't work on it)