Extract a substring from field


I would extract a substring from field for example

I have this field

type=USER_AUTH msg=audit(155558731.704:1977444): pid=126 uid=0 auid=42949672915 ses=42945 msg='op=PAM:authentication grantors=pam_unix acct="rodrigo.adsa" exe="/usr/sbin/sshd" hostname=baseserver addr= terminal=ssh res=success

I would to create SUB field for exemple

@acct "rodrigo.adsa"
@hostname baseserver

I know that it's possible made this from "script field" and also with GROK INGEST
Which is the best solution
How I can do this?

The best solution is to do this at ingest as it will be less resource intensive. I recommend asking in the Logstash forums as they have more expertise on this.

Yes I know but i've used a Elasticsearch service on AWS, so I put data into elastic cluster with lamba function, so i prefer for now to use script field. is it possible?

Yes, you probably want to go with ingest pipeline then

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.