Logstash conditional truncate on message length

Question

I'm new to logstash configuration and i try to add a condition on the truncate plugin.

My goal is to use this plugin only if my message length is greater than n byte and then add a tag.

Why using a condition ? Because the plugin add the tag even if the message is not truncated.

here my conf :

truncate {
    fields => "message"
    length_bytes => 2000
    add_tag => [ "truncated_msg" ]
}

I tryed differents conditions like these :

if event['message'].length > 2000 {
    truncate {
        fields => "message"
        length_bytes => 2000
        add_tag => [ "truncated_msg" ]
    }
  }

if field['message'].length > 2000 {
    truncate {
        fields => "message"
        length_bytes => 2000
        add_tag => [ "truncated_msg" ]
    }
  }

but they get me error while lunching logstash.

So if anybody have a solution to how i can condition the trucate i'll be very gratefull.

Answer 1

thanks to baudsp answer, the conditional work. here a quick snippet from the corrected conf :

if [message] =~ /.{4000,}/ {
    truncate {
        fields => "message"
        length_bytes => 4000
        add_tag => [ "truncated_msg" ]
    }
}