Logstash config, "if string contains..." - logstash

So, let's assume that I have a portion of a log line that looks something like this:
GET /restAPI/callMethod1/8675309
The GET matches a http method, and get's extracted, the remainder matches a URI, and also gets extracted. Now in the logstash config let's assume that I wanted to do something like this...
if [METHOD] == "GET" {
if [URI] (CONTAINS <--Is there a way to do this?) =="restAPI/callMethod1"{
....
Is there some way to do this? If so how would I go about doing that?
Thanks

You can achieve it simply by using the =~ (regexp) operator like this (see conditionals):
if [METHOD] == "GET" {
if [URI] =~ /restAPI\/callMethod1/ {
...

Related

check if the variable contains character a-z or A-Z in Groovy

I'm very new to Groovy and started learning with that.
My requirement is to validate if my input variable contains the character between a-z or A- then I have to remove this particular record.
I tried with
personIdExternal.text().contains('a-z')
I also tried with
personIdExternal.text().matches("[a-zA-Z]")
And neither is working.
Can you guys please help me out?
You can do something like this:
if(personIdExternal.text() ==~ /.*[A-Za-z].*/) {
println 'it matches'
} else {
println 'it does not match'
}

IDX condition in a getresource tpl

I use getresource like this:
[[!getResources? &tpl=`coffrets_id` &parents=`1115`]]
inside coffrets_id tpl I'd like to be able to do something like this:
[[+idx:is=`1`:then=`show only first getressrouce result`:else=``]]
[[+idx:is=`2`:then=`show only second getressrouce result`:else=``]]
[[+idx:is=`3`:then=`show only third getressrouce result`:else=``]]...
but I have no idea how to show only the result that matches the idx. Is there any solution?
Just use Templating Properties
[[!getResources?
&tpl=`coffrets_id`
&tpl_1=`coffrets_id_1`
&tpl_2=`coffrets_id_2`
&tpl_3=`coffrets_id_3`
&parents=`1115`
]]

Gradle: How to filter and search through text?

I'm fairly new to gradle. How do I filter text in the following manner?
Pretend that the output/result I want to filter will be the two URLs below.
"http://localhost/artifactory/appNameIwant/moreStuffHereThatsDynamic"
> I want this URL
"http://localhost/artifactory/differentAppName"
> I don't want this URL
I want to put up a "match" variable that would be something like
variable = http://localhost/artifactory/appnameIwant
So essentially, the string will not be a perfect match. I want it to filter and provide back any URLs that start with the variable listed above. It cannot be a perfect match as the characters after the /appnameIwant/ will be changing.
I want to use a for loop to cycle through an array, with an if then statement to return any matches. For instance.
for (i=0; i < results.length; i++){
if (results[i] strings matches (http://localhost/artifactory/appnameIwant) {
return results[i] }
I am just filtering the URL strings themselves, not anything complicated inside the webpages.
Let me know if further explanation would be helpful.
Thanks so much for your time and help!
I figured it out - I just used
if (string.startsWith"texthere")) {println string}
A lot easier than I thought!

Groovy - How can I compare part of a list to a string

I have a list which contains two types of text. One type is used for authorization while other type is used for all other purposes.
The type used for authorization always uses the same text + some code after it.
I would like to compare content of these two types of text and separate them based on content.
My idea is to look for pattern in authorization type and if it matches the pattern then this would be marked as authorization, otherwise it would be marked as "other".
I researched about comparison of patterns in Groovy, but all variations I tried did not work for me. Here is the part which should do the comparison, I am obviously doing something wrong but I don't know what.
jdbcOperations.queryForList(sql).collect { row ->
if(assert (row['MSG'] ==~ /token/)){
mark as authorization
}
else{
mark as other
}
}
Sorry for the vague code, I can not share more than this.
I think you just missing the match for the rest of the text, since you are looking only for the first part to match.
assert ("abc" ==~ /abc/) == true
assert ("abcdefg" ==~ /abc/) == false
assert ("abcdefg" ==~ /abc(.*)/) == true // <--- This can also be made more complicated

preg_replace: reference object in replacement

Do you know of any way to reference an object in the replacement part of preg_replace. I'm trying to replace placeholders (delimited with precentage signs) in a string with the values of attributes of an object. This will be executed in the object itself, so I tried all kinds of ways to refer to $this with the /e modifier. Something like this:
/* for instance, I'm trying to replace
* %firstName% with $this->firstName
* %lastName% with $this->lastName
* etc..
*/
$result = preg_replace( '~(%(.*?)%)~e', "${'this}->{'\\2'}", $template );
I can't get any variation on this theme to work. One of the messages I've been getting is: Can't convert object Model_User to string.
But of course, it's not my intention to convert the object represented by $this to a string... I want to grab the attribute of the object that matches the placeholder (without the percentage signs of course).
I think I'm on the right track with the /e modifier. But not entirely sure about this either. Maybe this can be achieved much more simple?
Any ideas about this? Thank you in advance.
Like I commented to Paul's answer: in the meanwhile I found the solution myself. The solution is much more simple than I thought. I shouldn't have used double quotes.
The solution is as simple as this:
$result = preg_replace( '~(%(.*?)%)~e', '$this->\\2', $template );
Hope this helps anyone else for future reference.
Cheers.
Check out preg_replace_callback - here's how you might use it.
class YourObject
{
...
//add a method like this to your class to act as a callback
//for preg_replace_callback...
function doReplace($matches)
{
return $this->{$matches[2]};
}
}
//here's how you might use it
$result = preg_replace_callback(
'~(%(.*?)%)~e',
array($yourObj, "doReplace"),
$template);
Alternatively, using the /e modifier, you could maybe try this. I think the only way to make it work for your case would be to put your object into global scope
$GLOBALS['yourObj']=$this;
$result = preg_replace( '~(%(.*?)%)~e', "\$GLOBALS['yourObj']->\\2", $template );

Resources