How can I drop the domain from field in logstash?

I want to remove domain from field coming from metricbeat.

For example: = =

I want to remove everything after . or @ or any other delimiter to save the value of field like: = abcd = abc

How can I do that in logstash?

You could try it using a mutate filter

mutate { gsub => [ "[host][name]", "([A-Za-z0-9_]*)[\.@].*", "\1" ] }

Is this expression storing the substring in [host][name] before . or @?

It uses a capture group (the parentheses around [A-Za-z0-9_]*), and references the first capture group in the substitution using \1.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.