Create new field from existing one

Create new field with proper url content.

this path are sometime 10 level deep and sometime 20.

this is what I have

full_file_name:  /home/sachin/Tests/noise/spread/xspread/
project: sachin

to new field 

url_file: 'http://server1/Projects/JMV3/less_file.php?project=sachin&act=multiview&path=%2F%2Fhome%2sachin%2FTests%2Fnoise%2Fspread%2Fspred%2F&'

seems like I have to add follwing in beginning of the path

and then replace all / with %2F and add

how do I do it?

I have used grok and created this and it works.
actually this was old method where I needed %2F no more I can just pass the path with /

mutate {
add_field => { "file_url" => "http://server/Projects/JM/less_file.php?act=multiview&proj=%{project}&path=%{location}/&files=%{file_name}.gz" }

and from full path I got file_name
grok {
match => { "file_path" => "%{GREEDYDATA:api_class}" }
mutate {
# split the field on /
split => ["api_class" , "/"]
# save the last element of the array as the api_method.
add_field => ["file_name", "%{[api_class][-1]}" ]

grok { match => { "file_path" => "%{GREEDYDATA:location}(/%{DATA}.log)" } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.