Extracting a substring


(sandeep narla) #1

I was wondering what I can use to extract the first three letters of a given string

"/opt/LogStashOutputFormatted/TMOES/TNTMO072.2018-05-02_08:40.log"

I want to extract " TNT" from the string was able to extract TNTMO072 this using the dissect filter

dissect {
mapping => {
"path" => "/%{folder1}/%{folder2}/%{folder3}/%{TmoesNodename}.%{LogName}"
}
}

any suggestestions would be great


Creating a new field based on substring
#2

I would do it using grok.

grok { match => [ "fieldContainingTNTMO072", "^(?<threeLetters>...)" ] }

(sandeep narla) #3

thanks @Badger


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.