Get specific string from field in logstash

Elastic Stack Logstash
1

Hello, I'm new to logstash and I'm having trouble with this.
I configured filebeat to receive Nginx log:
This is sample input:

  "log": {
    "offset": 2234788,
    "file": {
      "path": "/nginxlogs/nginx.abc.1234.access.log"
    }
  },

the path could be *.error.log
I need to get the string "nginx.abc.1234" from the path. Can anyone help me with this?
Thank you very much

2

I hope that I got your request right?

grok {
  match => { "[log][file][path]" => ".*\/(?<yourstring>.+)\.(error|access)\.log$"}
}
3

You can use a ruby filter

ruby {
   code => " 
       event.set('nginxname',event.get('[log][file][path]').split('/')[-1].split('.')[0..2])
    "
}

It will be stored in ngnixname field

4

Thanks, this match is working with my string but how can I separate "nginx.abc.1234" into my field

5

This work first try. Thank you very much :smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.