Drop message content

Elastic Stack Logstash
1

hi all,
message content
07/20/20 23:57:48 INFO transfercity:sh(city/cityTransferQueryBusiness.cpp:72)

how to only get
07/20/20 23:57:48 INFO transfercity:sh

2

Hi,

You should look into grok patterns here is the documentation : https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html

You can always test those pattern inside your Kibana in the "Dev Tools" > "Grok Debugger"

Good luck !

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.