Logstash compare a field to a number

Question

I'm searching a way to compare a Logstash field to a number in a conditional statement, but couldn't find anything in the documentation.

Something like this for example:

if [myfiels] => 1{
           mutate {
                   add_field => ["fild", "1"]
           }

or

if [myfiels] >= 1 and [myfiels] <= 3 {
               mutate {
                       add_field => ["fild", "2"]
               }

Thanks.

Answer 1

You first need to convert column type.

input {
   stdin{}
}

filter {
    grok {
        match => ["message","%{NUMBER:num}" ]
    }
    mutate {
        convert => { "num" => "integer" }
    }
    if [num] >= 5 {
        mutate { 
            add_field => { "xyz" => "123" }
        }
    }
}

output {
    stdout { codec => rubydebug }
}