# Extract string from a field in logstash

**URL:** <https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736>\
**Category:** Logstash\
**Created:** [November 13, 2019, 3:52pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736 "2019-11-13T15:52:31Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![aasoft](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@aasoft](https://discuss.elastic.co/u/aasoft)\
**Post date:** [November 13, 2019, 3:52pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/1 "2019-11-13T15:52:31Z")

</div>

I have a field in my index as:  
"url" : "[http://myaddress](http://myaddress):myport/ **mydoc** -3.docx"  
I would like to create a new field ("newid") and put the extracted value **mydoc** to it.  
basically I want to capture the document name with extension and without the number after "-".

I tried to split the "url" by "/" and capture mydoc-3.docx. Then split mydoc-3.docx by "-" and capture mydoc in two separate split as below but with not much success.

filter {  
mutate {  
split =\> { "url" =\> "/" }  
add\_field =\> { "my\_id" =\> "%{[url][3]}" }  
split =\> { [url][3] =\> "-" }  
add\_field =\> { "newid" =\> "%{[url][3][0]}" }  
}  
}  
But the second split doesn't work.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 13, 2019, 4:01pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/2 "2019-11-13T16:01:57Z")

</div>

You could do it using grok.

grok { match =\> { "url" =\> "/%{WORD:newid}-" } }

---

<div class="post-metadata">

**Author:** ![aasoft](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@aasoft](https://discuss.elastic.co/u/aasoft)\
**Post date:** [November 13, 2019, 5:26pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/3 "2019-11-13T17:26:46Z")

</div>

Should it be under filter like below? I do need to keep my\_id and I need to create a new field newid.  
For some reason below doesn't work. Most probably I didn't put grok in the right place.

filter {  
mutate {  
split =\> { "url" =\> "/" }  
add\_field =\> { "my\_id" =\> "%{[url][3]}" }  
}  
grok { match =\> { "url" =\> "/%{WORD:newid}-" } }

}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 13, 2019, 5:41pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/4 "2019-11-13T17:41:51Z")

</div>

The grok would have to come before the mutate+split, since the split has the effect of removing the / that the grok refers to.

---

<div class="post-metadata">

**Author:** ![aasoft](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@aasoft](https://discuss.elastic.co/u/aasoft)\
**Post date:** [November 13, 2019, 6:04pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/5 "2019-11-13T18:04:12Z")

</div>

Thanks. It worked!  
Now I have to do a couple of cleanup as below:  
filter {  
mutate {  
remove\_field =\> ["url"]  
convert =\> { "newid" =\> "integer" }  
}  
}  
Can I do in the same logstash and in the same filter and mutate?  
For some reason I could not and I had to create a second logstash to remove url field and convert newid to integer because it is really an integer.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 13, 2019, 6:28pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/6 "2019-11-13T18:28:56Z")

</div>

> [@aasoft](#):
>
> Can I do in the same logstash and in the same filter and mutate?

You should be able to do that in the same filter section that the grok is in, after the grok, of course. What problem did you have when you tried it?

---

<div class="post-metadata">

**Author:** ![aasoft](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@aasoft](https://discuss.elastic.co/u/aasoft)\
**Post date:** [November 14, 2019, 1:30pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/7 "2019-11-14T13:30:29Z")

</div>

I was able to merge all to one filter. it is working.  
So I use index1 as input and make index2 as output.  
So far so good.  
The next step (hopefully the last step) is to use index2 and add index3 to it as input and make index4 as output.  
Currently I made this as a separate logstash.  
So I have one logstash to do:  
index1 ----\>user filter and some staff ---\>index2  
And the other logstash to do:  
index1,index2-----\>user filter and some staff---\>index4  
Can I merge both logstash to one?

---

<div class="post-metadata">

**Author:** ![aasoft](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@aasoft](https://discuss.elastic.co/u/aasoft)\
**Post date:** [November 14, 2019, 6:24pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/8 "2019-11-14T18:24:40Z")

</div>

I tried to merge and it worked!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2019, 6:24pm UTC](https://discuss.elastic.co/t/extract-string-from-a-field-in-logstash/207736/9 "2019-12-12T18:24:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.