I need to duplicate my event field and manipulate the string field length to 5 characters .
This is my sample log: {"LogLevel":"INFO","LogMsg":"Checked existing Slots ... 180 more lines","Time":"2017-08-21_12:01:48.882"}
1- i need "LogMsg" field to be duplicated with another new field name and truncate that new string field length to 5 character.
Thanks for the reply..it worked for me
this is my filter:
mutate {
add_field => { "ErrorMsg" => "%{errorMessage}" }
}
truncate {
fields => "ErrorMsg"
length_bytes => 1000
}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.