hi, I'm using grok to pull out the user_id field
grok { match => { "authDN" => "uid=%{GREEDYDATA:user_id}," } }
My field user_id=0212345678
I always need to delete the first 0 and insert 421. HOW?
0212345678 -> 421212345678
hi, I'm using grok to pull out the user_id field
grok { match => { "authDN" => "uid=%{GREEDYDATA:user_id}," } }
My field user_id=0212345678
I always need to delete the first 0 and insert 421. HOW?
0212345678 -> 421212345678
You can you the mutate
filter with the gsub
function.
filter {
mutate {
gsub => ["[user_id]", "^0", "421" ]
}
}
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.