Grok pattern extract data based on column position

Elastic Stack Logstash
1

I have a mainframe export. I need to parse it based on column position. Does Logstash grok support extraction based on column position?

Example line: M4349456

First two characters dept number: M4
Characters 3-6 mail stop: 3494
Characters 7-8 room number: 56

2

Hi maybe you can follow this solution.

You can create a separate ruby code block and put the zero based integer.

3

You can do it in grok using

    grok { match => { "someField" => "^(?<dept>..)(?<mailstop>....)(?<room>..)" } }
1 Like
4

Thank you Archelle and Badger both information was useful. I ended up using Badger's recommendation.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.