Extracting a substring

I was wondering what I can use to extract the first three letters of a given string


I want to extract " TNT" from the string was able to extract TNTMO072 this using the dissect filter

dissect {
mapping => {
"path" => "/%{folder1}/%{folder2}/%{folder3}/%{TmoesNodename}.%{LogName}"

any suggestestions would be great

I would do it using grok.

grok { match => [ "fieldContainingTNTMO072", "^(?<threeLetters>...)" ] }

thanks @Badger

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.