rubyadditionlogstash-grok

Logstash Grok Compute match values

I'm trying to compute values from grok patterns. My data is sending from filebeat to logstash.

My simple grok pattern dor testing:

match => ["message", "^%{INT:nb1} \| %{INT:nb2}$"]

I want to add this 2 values (nb1 & nb2).

I tried this 2 possibilities:

mutate { add_field => { "test_Duration" => "%{nb1}+%{nb2}" } }

In result I had a string:

ruby {
            code => "
             res = event['nb1'].to_i + event['nb2'].to_i;
            event.set('test', res);  "
          }

In ruby code I can't get nb1 & nb2 values.

Solution

  • Use ruby code with event.get('var').to_i

    res =  event.get('nb1').to_i + event.get('nb2').to_i;
event.set('test', res);