Extract last 2 characters of a given string


I have a requirement to extract last 2 characters from a given string. Please let me know which logstash function I can use to achieve this.


You can do that using grok.

grok { match => [ "somefield", "(?<lastTwo>..)$" ] }

Hi Badger,

Thanks for the reply, can you please give an example to understand more.


I am using a grok custom pattern. It matches two characters (..) anchored at the end of a line / string (using $).

Note that if you pass a multi-line field to this grok it will match the end of the first line. If you want to match the end of a multi-line field then change $ to \z.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.