Logstash mutate gsub not working inside "if" statement

0
votes

i have an issue using logstash mutate filter gsub.

Required

Remove "ZC" characters of a field and coverting it into float

{
      "field" => "12.343,40ZC",
      "@timestamp" => 2020-01-06T23:00:00.000Z
}

Expected output

{
       "field" => "-12343,40",
       "@timestamp" => 2020-01-06T23:00:00.000Z
}

Code not working

filter{
  if "ZC" in "field" {
    mutate { gsub => ["field","ZC",""] } 
  }
}

Code working

filter{
    mutate { gsub => ["field","ZC",""] } 
}

I need the "if" statement because depends if the two characters exist inside the field to make a positive or negative float.

1
logstash

1 Answers

3
votes

Your conditional is wrong, if you use "field" logstash understands that as a string with the value field, the correct way is to use the format [field].

Change your conditional to the following.

filter {
  if "ZC" in [field] {
    mutate { gsub => ["field","ZC",""] } 
  }
}