Add new fields based on hostname substring

Elastic Stack Logstash
1

Hi guys,

i want to add new fields based on the information in hostname. Below the examples of what i need,

hostname=alfrdnsresolverfixed01
new fields: site=alfr, dns_type=fixed

hostname=boavdnsresolvermbbnat01
new fields: site=boav, dns_type=mbbnat

so site is the first 4 chars of hostname and dns_type is between dnsresolver and last 2 digits

thanks,

2

Use grok

grok { match => { "hostname" => "^%{WORD:site}dnsresolver%{WORD:dns_type}\d" } }
1 Like
3

more simple than i thought.

@Badger \ d in the end what means? 1 digit, 1 or more digits, something else...?

4

\d means one digit. That may be followed by another digit or anything else. There is no need to match the entire field.

1 Like
5

need to adjust things but work like a charm.

many thanks @Badger