Add a field starting from a substring of the file name

Elastic Stack Logstash
1

Hello.
I have several logs with the following names, where [E-1].[P-28], [E-1].[P-45] and [E-1].[P-51] are operators that generate these logs (I only can identify them by obtaining from the file name)

p2sajava131.srv.gva.es_11101.log.online.[E-1].[P-28].21.01.21.log
p1sajava130.srv.gva.es_11101.log.online.[E-1].[P-45].21.03.04.log
p1sajava130.srv.gva.es_11101.log.online.[E-1].[P-51].21.03.04.log
...

How can i create a new field with, mutate o translate in logstash, with the next conditions:
if contains [E-1].[P-28] => Operator-1
if contains [E-1].[P-45] => Operator-2
if contains [E-1].[P-51] => Operator-3

Thanx

2 
    translate {
        field => "[message]"
        destination => "[someField]"
        dictionary => {
          "\[E-1\]\.\[P-28\]" => "Operator-1"
          "\[E-1\]\.\[P-45\]" => "Operator-2"
          "\[E-1\]\.\[P-51\]" => "Operator-3"
        }
        exact => true
        regex => true
    }

will produce events like

 "someField" => "Operator-3",
   "message" => "p1sajava130.srv.gva.es_11101.log.online.[E-1].[P-51].21.03.04.log",

Note that you do not appear to be using a regex, but it needs to be true to do a substring match.

3

Lot of Thanx Badger.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.