How to pick range of splitted field in mutate filter

Elastic Stack Logstash
1

I generate field on input:

input {
  generator {
    add_field => {
      "[kubernetes][pod][name]" => "aaaa-bbbb-a1b2c3"
    }
    count => 1
  }
}

I need to remove last part of pod name a1b2c3. Iam trying to split it and pick the range from 0 to -1 but it does not work.

filter {
  mutate {
    split => ["[kubernetes][pod][name]", "-"]
    add_field => { "[@metadata][index]" => "%{[kubernetes][pod][name][0:-1]}" }
  }
}

Is it possible to pick range of indices? Is there better way how to do it? The reason is, i am harversting logs from kubernetes and I would like to use rollover indices. Then, I have to keep consistent indices names. Kubernetes unfortunatelly change the hash part so I have to remove it from name. Thank you.

2

If you just want the last entry in an array I would use

%{[kubernetes][pod][name][-1]}
3

Hi, thank you for your reply. I know how to pick exact index, but I need to pick all except last one.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.