Hello, I have a number which needs to be dissected into different fields using regex. I think It needs to be regex because the first set of number changes in length. I have been struggling to find a similar example anywhere, so can anyone help me in this? My number field is like: 123400000123000…

I'm going to assume you don't need fields 2, 4 and 6 since you know that they will always be what you noted (00000, 0000, 1) and could set them directly if needed ... so that leaves just the other 3 fields. For dissect: %{field1}00000%{field3}0000%{field5}1 For grok: (?<field1>(?>\d){4,5})00000(?<f…

system (system) Closed April 24, 2022, 3:33am 4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Create new field based on msg filed in logstash Logstash	11	8837	July 6, 2017
Remove part of a field Logstash	4	859	July 6, 2017
Pattern Assistance ## Logstash	4	820	July 6, 2017
Unable to Grok scientific notation numbers using ingest pipelines Elasticsearch	1	1378	June 12, 2018
DISSECT FILTER, field not always specified Logstash	5	1646	July 10, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to dissect/script/grok a long number into different fields using regex in an ingest pipeline?

Related topics