Extracting a substring

Elastic Stack Logstash
1

I was wondering what I can use to extract the first three letters of a given string

"/opt/LogStashOutputFormatted/TMOES/TNTMO072.2018-05-02_08:40.log"

I want to extract " TNT" from the string was able to extract TNTMO072 this using the dissect filter

dissect {
mapping => {
"path" => "/%{folder1}/%{folder2}/%{folder3}/%{TmoesNodename}.%{LogName}"
}
}

any suggestestions would be great

2

I would do it using grok.

grok { match => [ "fieldContainingTNTMO072", "^(?<threeLetters>...)" ] }
3

thanks @Badger

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.