Extract substring of a log line

[DFrant]

Hello,

I have some logs lines wich are only one string, for example :

01999918000170702135929%WS%00000000000070030819078820913135929050000080RRN0002W900500000000C0000000000000500024464063100100 03081907882 300 R00

I would know how it is possible to use a filter to extract field from this string using char index.
For example:

ID = substring(0,11)
date = substring(11, 17)
etc...

Thanks

[leandrojmp (Leandro Pereira)]

Maybe you can use the ruby filter to do that.

Should be something like this

filter {
    ruby {
        code => "
             event.set('ID', event.get('message')[0..11])
             event.set('date', event.get('message')[12..17])
        "
    }
} 

This way a field called ID will receive the substring for 0 to 11 from the source field message, which countains your log line, the same for the field date.

I was not able to test this yet, but in theory this should work.

You can read more of the ruby filter here

[DFrant]

Thanks for your answer.

I proceed with pattern matching and regex to proceed:

I defined patterns that i want to match with my log line:

ID (^.{0}.{11})
TESTTIMESTAMP (.{12})
...

And in my pattern matcher I did:

 match => { "message" => "%{ID:id}%{DATE:date}..."}