Extract only the variables from parentheses but the location is not the same

i have a problem when I want to extract a variables from parentheses.
my example : transactionIdentifier=0/0(016)0009/019953
from that information i need to create a new field and contain just the information that exist in parentheses, but I don't know how to do
the problem is i can't know at what line the information from parentheses will be start
that entry can be in different format like
transactionIdentifier=10/0(016)0009/019953 or
transactionIdentifier=110/10(016)0009/019953 or

For text with variable delimiters a dissect filter is a good match...

dissect { mapping => { "message" => "%{}(%{someField})%{}" } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.