Logstash type conversion not working in single mutate filter -


below mutate filter configuration, caller , callee data in below format. not working both caller , callee data set 0 on type conversion. conversion working fine when used separate mutate filter type conversion. why first configuration not working ?

"caller":"caller:123" "callee":"callee:123"  mutate {           gsub => [                    #regex remove : , every thing before                     "caller", "^[^:]*:", "",                                            "callee","^[^:]*:", ""                   ]           convert => {                       #type conversion string integer                         "caller" => "integer"                        "callee" => "integer"                                                   }                                                       } 

type conversion working fine 2 separate mutate filters used

      mutate {               gsub => [                        #regex remove : , every thing before                         "caller", "^[^:]*:", "",                                                "callee","^[^:]*:", ""                       ]        }              mutate {                      convert => { "caller" => "integer"                                   "callee"=>  "integer"                                   }                      }     

apparently, source code, convert operation called before gsub operation.

https://github.com/logstash-plugins/logstash-filter-mutate/blob/d8936feaa5c7141f96fdfbf1120f23ecdc816275/lib/logstash/filters/mutate.rb#l218:

  def filter(event)     ...     convert(event) if @convert     gsub(event) if @gsub 

Comments

Popular posts from this blog

networking - Vagrant-provisioned VirtualBox VM is not reachable from Ubuntu host -

c# - ASP.NET Core - There is already an object named 'AspNetRoles' in the database -

ruby on rails - ArgumentError: Missing host to link to! Please provide the :host parameter, set default_url_options[:host], or set :only_path to true -