How to change a number

hi, I'm using grok to pull out the user_id field
grok { match => { "authDN" => "uid=%{GREEDYDATA:user_id}," } }
My field user_id=0212345678
I always need to delete the first 0 and insert 421. HOW?

0212345678 -> 421212345678

You can you the mutate filter with the gsub function.

filter {
  mutate {
    gsub => ["[user_id]", "^0", "421" ]
  }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.