Field duplicate and truncate


(Jones Thomas) #1

I need to duplicate my event field and manipulate the string field length to 5 characters .
This is my sample log:
{"LogLevel":"INFO","LogMsg":"Checked existing Slots ... 180 more lines","Time":"2017-08-21_12:01:48.882"}

1- i need "LogMsg" field to be duplicated with another new field name and truncate that new string field length to 5 character.


(Jones Thomas) #2

is it possible??


(Magnus B├Ąck) #3

Copy the field with a mutate filter and use a truncate filter to truncate the new field.


(Jones Thomas) #4

Thanks for the reply..it worked for me
this is my filter:
mutate {
add_field => { "ErrorMsg" => "%{errorMessage}" }
}
truncate {
fields => "ErrorMsg"
length_bytes => 1000
}


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.