Create a field with information from another field

[pmo (morry)]

Hi expert,
I would like to know if it's possible to create a new field with information that are taken from another field.
I'm using sql connection.

I've a field named :

• Code_postal (that has 3 or 5 digits - I only need to take care of the 5 digits)

I would like to create a field named :

• departement (should take the 2 first digits of the Code_postal field).

How Can I do that in logstash, I was thinking about Regexp to do that but never see any exemple.

Best Regards,
PM

[Badger]

You could try

grok { match => { "Code_postal" => "^(?<departement>[\d]{2})" } }