CODEWITHSUNDEEP
logstashlogstash-configuration
Erwan Le Tutour
Erwan Le Tutour

Reputation: 99

Logstash conditional truncate on message length

I'm new to logstash configuration and i try to add a condition on the truncate plugin.

My goal is to use this plugin only if my message length is greater than n byte and then add a tag.

Why using a condition ? Because the plugin add the tag even if the message is not truncated.

here my conf :

truncate {
    fields => "message"
    length_bytes => 2000
    add_tag => [ "truncated_msg" ]
}

I tryed differents conditions like these :

if event['message'].length > 2000 {
    truncate {
        fields => "message"
        length_bytes => 2000
        add_tag => [ "truncated_msg" ]
    }
  }

if field['message'].length > 2000 {
    truncate {
        fields => "message"
        length_bytes => 2000
        add_tag => [ "truncated_msg" ]
    }
  }

but they get me error while lunching logstash.

So if anybody have a solution to how i can condition the trucate i'll be very gratefull.

Upvotes: 1

Views: 1846

Answers (1)

Erwan Le Tutour
Erwan Le Tutour

Reputation: 99

thanks to baudsp answer, the conditional work. here a quick snippet from the corrected conf :

if [message] =~ /.{4000,}/ {
    truncate {
        fields => "message"
        length_bytes => 4000
        add_tag => [ "truncated_msg" ]
    }
}

Upvotes: 1

Related Questions