Extract strings from one field

Elastic Stack Logstash
1

After successfully parsing out this field from my log files, I want to extract information from this field and store it as a separate field, I looked through lots of the filters and didn't find one that serves this purpose, the field looks like this:

/content/folder[@name='*', Inc (t0030427da5p)']/reportView[@name=' **** ** **** ** *** *******']

It should be like a path(text replaced by stars for company's sake), I want information between the bracket, or even better the two names(represented by stars). Any hints would be really appreciated <:

2

Use the grok filter. I'm not 100% sure what result you expect from the example input string, but if you want the text inside the two single-quoted strings the following should work:

grok {
  match => [
    "name-of-field",
    "@name='(?<name1>[^']+)'.*@name='(?<name2>[^']+)'"
  ]
]

If the single-quoted strings themselves can contain single quotes that are escaped somehow it'll take some more care.

3

Thank you magnus, you are great. I did came up with my own grok but yours is much prettier.

David