Field duplicate and truncate

I need to duplicate my event field and manipulate the string field length to 5 characters .
This is my sample log:
{"LogLevel":"INFO","LogMsg":"Checked existing Slots ... 180 more lines","Time":"2017-08-21_12:01:48.882"}

1- i need "LogMsg" field to be duplicated with another new field name and truncate that new string field length to 5 character.

is it possible??

Copy the field with a mutate filter and use a truncate filter to truncate the new field.

1 Like

Thanks for the reply..it worked for me
this is my filter:
mutate {
add_field => { "ErrorMsg" => "%{errorMessage}" }
}
truncate {
fields => "ErrorMsg"
length_bytes => 1000
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.