I am working on a way to be able to pull an area of data which is shown in a field. I would like to be able to run a scripted field to be able to pull out the intended data and to create a new field with it. But still keeping the original field as is.
for example with the data that I have been using to create this template is below (e.g. GET request):
So, from this, the data that I am trying to retrieve and create a new field is from the "Request" - the original field. To pull out the ID - "XXXXXXX-xxxx-XXXXX" and to great a new field called "ID" - new field.
Would this be better using scripted fields or would this be better with a grok or sort of filter in a Logstash conf?