Grab value from message field and add it to a new field

Elastic Stack Logstash
1

Hi,

How do i grab a particular value from my initial message field and use to configure it in a new field.

My message field looks like this:

2016-05-05 23:47:30,939 INFO [qtp796460995-1114] [puppet-server] Puppet 'store report' command for niraj-dev-03-shard2-mongodb03 submitted to PuppetDB with UUID 6c209aa7-540f-431f-88f5-75c84dca2fa7

I want the hostname niraj-dev-03-shard2-mongodb03 from my message field and use that to create a new field named host. How do i achieve this.

--
Niraj

2

You can use grok to match the entire pattern, then you can use that field elsewhere - https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html

3

It would be really helpful if you can demonstrate and example. I had a look at this website but seems to be bit confusing.

4

Maybe this will be better https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html#configuring-grok-filter

5 
grok {
  match => [ "message", "command for %{NOTSPACE:host}"]
}