Gork not work as excpected

Here is my gork filter:
\[SqlExceptionHelper\] SQL (Error|Warning Code): %{NUMBER:error_code}, SQLState: %{WORD:sql_state}

here is my log:

2023-06-30 01:54:38,867 WARN  CUS.InEP-APPGW-121662220 [SqlExceptionHelper] SQL Error: -271, SQLState: IX000
2023-06-30 18:55:11,863 WARN  CUS.InEP-APPGW-131544990_APP.InEP-APP2-131544666 [SqlExceptionHelper] SQL Warning Code: 0, SQLState: 01I01

current output:

  "error_code": "-271",
  "sql_state": "IX000"

expected output:

  "error_code": "271",
  "sql_state": "IX000"

need to remove that dash before number in match not with "if condition"

Any idea?

You can simple use gsub to remove -

mutate { gsub => [ "error_code", "-", "" ] }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.