i have a problem when I want to extract a variables from parentheses.
my example : transactionIdentifier=0/0(016)0009/019953
from that information i need to create a new field and contain just the information that exist in parentheses, but I don't know how to do
the problem is i can't know at what line the information from parentheses will be start
that entry can be in different format like
transactionIdentifier=10/0(016)0009/019953 or
transactionIdentifier=110/10(016)0009/019953 or
transactionIdentifier=0/50(0016)0009/019953
For text with variable delimiters a dissect filter is a good match...
dissect { mapping => { "message" => "%{}(%{someField})%{}" } }
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.