huh. can someone give me a suggestion how to turn ...
# fluent-bit
a
huh. can someone give me a suggestion how to turn "1" into a boolean? I have this extractor
Copy code
- name: content_modifier
            action: extract
            key: 'message'
            # print one line per reply, with time, IP, name, type, class, rcode, timetoresolve, fromcache and responsesize.
            pattern: '^(?<source_ip>[^ ]+) (?<query_request>[^ ]+) (?<query_record_type>[^ ]+) (?<query_class>[^ ]+) (?<query_result>[^ ]+) (?<unbound_time_to_resolve>[^ ]+) (?<unbound_from_cache>[^ ]+) (?<query_response_length>.+)$'
            condition:
              op: and
              rules:
                - field: '$message_type'
                  op: eq
                  value: 'reply'
          - name: content_modifier
            action: convert
            key: unbound_time_to_resolve
            converted_type: int
          - name: content_modifier
            action: convert
            key: query_response_length
            converted_type: int
          - name: content_modifier
            action: convert
            key: unbound_from_cache
            converted_type: boolean
but I'm still getting
Copy code
[3] log_unbound: [[1762491366.000000000, {}], {"process"=>"unbound", "pid"=>934, "tid"=>"1", "message_type"=>"reply", "message"=>"127.0.0.1 <http://vmetrics1.pawsey.org.au|vmetrics1.pawsey.org.au>. AAAA IN NOERROR 0.000000 1 109", "gim_event_type_code"=>"140200", "source_ip"=>"127.0.0.1", "query_request"=>"vmetrics1.pawsey.org.au.", "query_record_type"=>"AAAA", "query_class"=>"IN", "query_result"=>"NOERROR", "unbound_time_to_resolve"=>"0.000000", "unbound_from_cache"=>"1", "query_response_length"=>"109", "cluster"=>"DNS", "event_reporter"=>"ns0"}]