I have a number which needs to be dissected into different fields using regex. I think It needs to be regex because the first set of number changes in length.
I have been struggling to find a similar example anywhere, so can anyone help me in this?
My number field is like:
This needs to be separated into different fields like:
Sometime the field1 can have 1-4 digits. Field2 will always have 5 zeros, field3 will always 3 digits, field4 will always have 4 zeros, field 5 will always have 4 digits and then field 6 will always be a number 1 which indicates the end of string.
I'm going to assume you don't need fields 2, 4 and 6 since you know that they will always be what you noted (00000, 0000, 1) and could set them directly if needed ... so that leaves just the other 3 fields.
NOTE: I didn't actually try these out in Logstash, I only quickly tested these in the online dissect tester and grok debugger.
Thank you so much. Yes, you are absolutely right and I don't need the field #2, 4 and 6.
I tried the dissect filter and it works great only if the ending digit of the field1 is not ending with 0. If it ends with 0 then for some reason that 0 is added to the field3 which is not we want.
The grok pattern works in the grok debugger and dev tools but I am not able to add the same pattern in the ingest pipeline and its giving me a "Invalid JSON String" error message.
But your grok pattern helped me in creating my own regex in the following format:
and I was able to get the result I needed.
Now that it works:
I can use this regex too:
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.