How many times does a character appear?

I would like to be able to find out how many times a character appears in a field. Is this possible with grok or some other filter?

To explain, we are getting beats from multiple sources, and multiple departments in my company. There is a standardized field, that has a delimiter character, which I use dissect its data. However, we have a new division that needs more information and wants to increase the amount of delimited data in this field. The issue I have is that the added information is an inside delimited value. The below is a quick example, where there is an extra value ( -loc- ) inside. And, of course there are very different rules for processing these.

My thought is to count how many dashes there are to know how to process. Is this doable in a Logstash filter (grok?), or is there another approach that I should consider?

For example:



Would the logstash kv filter be able to do this?

filter {
  mutate {
    add_field => ["dotcount"]
  ruby {
    code => "dotcount = message.count(\".\")"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.