Add a field if match

Question

i'm triyng to monitor an irc server. And i'm loot for a way to create a new numeral field (example: Alert_level) only if a message match a specific word inside. Example: Message: ABC | Alert_level: 1 ; Message: ZYX | Alert_level: 3.

Its the running code

input {
        irc {
                channels => "#xyz"
                host => "a.b.c"
                nick => "myusername"
                catch_all => true
          get_stats => true
        }
}


output {
        stdout { codec => "rubydebug" }
        elasticsearch {
                                        hosts => "localhost"
                                        index => "logstash-irc-%{+YYYY.MM.dd}"
        }
}

Thank you!

Answer 1

As @Val suggested above you might need to use the grok filter in order match something from the input. For example your filter could look something like this:

filter {        
    grok {
        match => { "message" => "%{GREEDYDATA:somedata}" }          
    }

    if "ZYX" in [message]{ <-- change your condition accordingly
        mutate {
            add_field => { "%{Alert_level}" => "12345" } <-- somefield is the field name
            convert => { "Alert_level" => "integer" }    <-- do the conversion
        }

    }   
}

NOTE that you have to do the conversion in order to create a numeric field through logstash, where you can't directly create one. The above is just a sample so that you can reproduce. Do change the grok match in respect to your requirement. Hope it helps!