Add a field starting from a substring of the file name

I have several logs with the following names, where [E-1].[P-28], [E-1].[P-45] and [E-1].[P-51] are operators that generate these logs (I only can identify them by obtaining from the file name)[E-1].[P-28].21.01.21.log[E-1].[P-45].21.03.04.log[E-1].[P-51].21.03.04.log

How can i create a new field with, mutate o translate in logstash, with the next conditions:
if contains [E-1].[P-28] => Operator-1
if contains [E-1].[P-45] => Operator-2
if contains [E-1].[P-51] => Operator-3


    translate {
        field => "[message]"
        destination => "[someField]"
        dictionary => {
          "\[E-1\]\.\[P-28\]" => "Operator-1"
          "\[E-1\]\.\[P-45\]" => "Operator-2"
          "\[E-1\]\.\[P-51\]" => "Operator-3"
        exact => true
        regex => true

will produce events like

 "someField" => "Operator-3",
   "message" => "[E-1].[P-51].21.03.04.log",

Note that you do not appear to be using a regex, but it needs to be true to do a substring match.

Lot of Thanx Badger.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.