Nagios Support Forum

Posted: **Sun Jun 17, 2018 5:53 pm**

Hi Support,

We have more than 500 hundred network switches and we want to change the filed "type" to network.
I used following configuration but its not working.

if [host] == "10.100.250.*" { mutate { replace => { "type" => "Network" } } }
if [host] == "10.100.251.*" { mutate { replace => { "type" => "Network" } } }

Thanks,

Posted: **Mon Jun 18, 2018 8:09 am**

Logstash uses the =~ operator to match regular expressions. See this page for more info:
https://www.elastic.co/guide/en/logstas ... ation.html

Try this:

Code: Select all

if [host] =~ /10\.100\.250\..*/ { mutate { replace => { "type" => "Network" } } }
if [host] =~ /10\.100\.251\..*/ { mutate { replace => { "type" => "Network" } } }

Note that I have escaped the octet separators.

Posted: **Mon Jun 18, 2018 9:49 am**

Thanks for the assist, @mcapra!

Posted: **Mon Jun 18, 2018 11:53 pm**

Thanks @mcapra, I applied and it worked

Nagios Support Forum

Wildcard in logstash mutate filter

Wildcard in logstash mutate filter

Re: Wildcard in logstash mutate filter

Re: Wildcard in logstash mutate filter

Re: Wildcard in logstash mutate filter