Logstash type conversion not working in single mutate filter -
below mutate filter configuration, caller , callee data in below format. not working both caller , callee data set 0 on type conversion. conversion working fine when used separate mutate filter type conversion. why first configuration not working ?
"caller":"caller:123" "callee":"callee:123" mutate { gsub => [ #regex remove : , every thing before "caller", "^[^:]*:", "", "callee","^[^:]*:", "" ] convert => { #type conversion string integer "caller" => "integer" "callee" => "integer" } }
type conversion working fine 2 separate mutate filters used
mutate { gsub => [ #regex remove : , every thing before "caller", "^[^:]*:", "", "callee","^[^:]*:", "" ] } mutate { convert => { "caller" => "integer" "callee"=> "integer" } }
apparently, source code, convert operation called before gsub operation.
def filter(event) ... convert(event) if @convert gsub(event) if @gsub
Comments
Post a Comment