Extract last 2 characters of a given string

[kkrg (kiran)]

Hello,

I have a requirement to extract last 2 characters from a given string. Please let me know which logstash function I can use to achieve this.

Thanks,
Kiran

[Badger]

You can do that using grok.

grok { match => [ "somefield", "(?<lastTwo>..)$" ] }

[kkrg (kiran)]

Hi Badger,

Thanks for the reply, can you please give an example to understand more.

Thanks

[Badger]

I am using a grok custom pattern. It matches two characters (..) anchored at the end of a line / string (using $).

Note that if you pass a multi-line field to this grok it will match the end of the first line. If you want to match the end of a multi-line field then change $ to \z.