How to get offset value using Logstash Filter

Elastic Stack Logstash
1

How to get offset value from a hex string "0b590b5900000000263efd95"
say I want 0b printed in my new field "startmessage"

2

If you want to replace a field with the first two characters of that field then you can use

mutate { gsub => [ "hexValue", "^(..).*", "\1" ] }

If you want to keep the original field then use mutate+add_field to make a copy of the field first.

3

If i want to get field after two characters like in the above string I want to get 59 only? whats the procedure?

4

I did it with regex
"^..(..).*"

tell me syntax to retain the original value to be used further.

5

You can use mutate+add_field or mutate+copy.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.