Grok parser to return only numbers

(Ravi Shanker Reddy) #1

I have a field where I will get phone number. Here are the examples.

1 800 1234

If the format is matching anyone I want to save the number in ES like 18001234. Can anyone help for the grok pattern

(Colton) #2
     match => {"message" => ["%{INT:first} ?(-|\()?%{INT:second} ?(-|\))?%{INT:third}"]
     add_field => {

(Ravi Shanker Reddy) #3
filter {
  mutate {
    gsub => [
      "number", "[\s(-]", ""

I found out this. Which one is better to use???

(Colton) #4

Yours may be a touch more efficient. Use whichever one makes the most sense to you. That way if you need to change/adjust it you are confident in what is happening

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.