Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save omar-yassin/557e0a29d6bd1f2ff410f94d12061dc8 to your computer and use it in GitHub Desktop.
Save omar-yassin/557e0a29d6bd1f2ff410f94d12061dc8 to your computer and use it in GitHub Desktop.
Logstash: replace kv with ruby (save fields as string, int or float)
ruby {
code =>
"
fieldArray = event['lb_message'].split(' ');
for field in fieldArray
name = 'prefix_' + field.split('=')[0];
value = field.split('=')[1];
if value =~ /\A\d+\Z/
event[name] = value.to_i
elsif value =~ /(^(\d+)(\.)?(\d+)?)|(^(\d+)?(\.)(\d+))/
event[name] = value.to_f
else
new_value = value.to_s.gsub /\"/, ''
event[name] = new_value
end
end
"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment