Extract a substring from field

Elastic Stack Kibana
1

Hi,

I would extract a substring from field for example

I have this field

@message
type=USER_AUTH msg=audit(155558731.704:1977444): pid=126 uid=0 auid=42949672915 ses=42945 msg='op=PAM:authentication grantors=pam_unix acct="rodrigo.adsa" exe="/usr/sbin/sshd" hostname=baseserver addr=19.13.22.10 terminal=ssh res=success

I would to create SUB field for exemple

@type USER_AUTH
@acct "rodrigo.adsa"
@hostname baseserver

I know that it's possible made this from "script field" and also with GROK INGEST
Which is the best solution
How I can do this?

2

The best solution is to do this at ingest as it will be less resource intensive. I recommend asking in the Logstash forums as they have more expertise on this.

3

Yes I know but i've used a Elasticsearch service on AWS, so I put data into elastic cluster with lamba function, so i prefer for now to use script field. is it possible?

4

Yes, you probably want to go with ingest pipeline then
https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.