How to pick range of splitted field in mutate filter

I generate field on input:

input {
  generator {
    add_field => {
      "[kubernetes][pod][name]" => "aaaa-bbbb-a1b2c3"
    count => 1

I need to remove last part of pod name a1b2c3. Iam trying to split it and pick the range from 0 to -1 but it does not work.

filter {
  mutate {
    split => ["[kubernetes][pod][name]", "-"]
    add_field => { "[@metadata][index]" => "%{[kubernetes][pod][name][0:-1]}" }

Is it possible to pick range of indices? Is there better way how to do it? The reason is, i am harversting logs from kubernetes and I would like to use rollover indices. Then, I have to keep consistent indices names. Kubernetes unfortunatelly change the hash part so I have to remove it from name. Thank you.

If you just want the last entry in an array I would use


Hi, thank you for your reply. I know how to pick exact index, but I need to pick all except last one.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.