Elast alert substring

Elastic Stack Elasticsearch
1

Hello,

I am trying to parse my alerts, I want to get only a substring of a field (my field name is message).

Let me give you an example, actually, I use:

{
  "text": """
{{#context.hits}}
  - {{_source.message}}
{{/context.hits}}"""
}

And that display:

  • my first message12345
  • my second message56537

But I want only to select the 12 last character of each message, the result should be:

  • message12345
  • message56537

How can I do that, I have tried substring(12) but it is not working.

Any ideas ?
Many thanks

2

Hello @elastic_interogation

I believe the easiest way will be to have an ingest pipeline and save the last 12 characters in a new field message_alert & this field you can use in your alerting.

Thanks!!