Grab value from message field and add it to a new field


How do i grab a particular value from my initial message field and use to configure it in a new field.

My message field looks like this:

2016-05-05 23:47:30,939 INFO [qtp796460995-1114] [puppet-server] Puppet 'store report' command for niraj-dev-03-shard2-mongodb03 submitted to PuppetDB with UUID 6c209aa7-540f-431f-88f5-75c84dca2fa7

I want the hostname niraj-dev-03-shard2-mongodb03 from my message field and use that to create a new field named host. How do i achieve this.


You can use grok to match the entire pattern, then you can use that field elsewhere -

It would be really helpful if you can demonstrate and example. I had a look at this website but seems to be bit confusing.

Maybe this will be better

grok {
  match => [ "message", "command for %{NOTSPACE:host}"]