Wildcard in logstash mutate filter

[HASupport]

Hi Support,

We have more than 500 hundred network switches and we want to change the filed "type" to network.
I used following configuration but its not working.

if [host] == "10.100.250.*" { mutate { replace => { "type" => "Network" } } }
if [host] == "10.100.251.*" { mutate { replace => { "type" => "Network" } } }

Thanks,

[mcapra]

Logstash uses the =~ operator to match regular expressions. See this page for more info:
https://www.elastic.co/guide/en/logstas ... ation.html

Try this:

Code: Select all

if [host] =~ /10\.100\.250\..*/ { mutate { replace => { "type" => "Network" } } }
if [host] =~ /10\.100\.251\..*/ { mutate { replace => { "type" => "Network" } } }

Note that I have escaped the octet separators.

[cdienger]

Thanks for the assist, @mcapra!

[HASupport]

Thanks @mcapra, I applied and it worked