i want to delete certain lines in the messsage field using logstash .I don't want to drop the field just extra lines in the field. is it possible ?
Are you saying you want to keep only the first line in the message field? If so then you could try
mutate { gsub => [ "message", "\n.*", "" ] }
i don't want just to keep the first line.i want to delete lines into the message field and keep others.I don't find a solution to do it
You need to share an example of your message and what you want to remove to see if it is possible or not and how to do it.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.