Add new field from an old one [Solved]


(Taloub) #1

Hello, I have the field Mat equal to:

Mat = "07/07/2017-03:09:39 0235918 LEFER GUILLAUME Tps"

and I did this but it doesn't work

mutate {
				split => { "Mat" => " " }
				remove_field => ["Mat[2]","Mat[2]","Mat[2]"]
				
			}
			mutate {
				add_field => {"time" => "%{Mat[0]}"}
				add_field => {"matricule" => "%{Mat[1]}"}
			}

can you help me please !! how can I create a new field from a hash table

Thanks :slight_smile:


(Taloub) #2

Solved by doing this :slight_smile:

grok {
    match => [ "Mat", "%{NOTSPACE:time} %{NOTSPACE:matricule} %{NOTSPACE:matri}"]
}
mutate {
    remove_field => ["matri"]
    remove_field => ["Mat"]
}

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.