How to get offset value using Logstash Filter

(sana1) #1

How to get offset value from a hex string "0b590b5900000000263efd95"
say I want 0b printed in my new field "startmessage"

#2

If you want to replace a field with the first two characters of that field then you can use

mutate { gsub => [ "hexValue", "^(..).*", "\1" ] }

If you want to keep the original field then use mutate+add_field to make a copy of the field first.

(sana1) #3

If i want to get field after two characters like in the above string I want to get 59 only? whats the procedure?

(sana1) #4

I did it with regex
"^..(..).*"

tell me syntax to retain the original value to be used further.

#5

You can use mutate+add_field or mutate+copy.

(system) closed #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.