# Logstash Dissect and mutate filter

**URL:** <https://discuss.elastic.co/t/logstash-dissect-and-mutate-filter/169042>\
**Category:** Logstash\
**Created:** [February 19, 2019, 2:37pm UTC](https://discuss.elastic.co/t/logstash-dissect-and-mutate-filter/169042 "2019-02-19T14:37:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![osheap](https://avatars.discourse-cdn.com/v4/letter/o/50afbb/32.png) [@osheap](https://discuss.elastic.co/u/osheap)\
**Post date:** [February 19, 2019, 2:37pm UTC](https://discuss.elastic.co/t/logstash-dissect-and-mutate-filter/169042/1 "2019-02-19T14:37:55Z")

</div>

I am trying to strip a number of characters from a field:  
"192.168.0.1/12345" should become "192.168.0.1" for example. I tried to create a mutate/split filter and that sort of does something as it splits the field into 192.168.0.1, 12345.

There must be a very easy way to achieve what I want to achieve, I have been looking for other examples but have not found one.

This is how my filter in logstash.conf looks like (before this a Grok filter correctly sorts out the syslog fields)

\</\>  
filter {  
if [syslog\_program] == "dnsmasq" {  
dissect {  
mapping =\> {  
"message" =\> "%{} %{} %{} %{} %{} %{} %{dns\_source} %{} %{dns\_resolv}"  
}  
}  
mutate {  
split =\> { "dns\_source" =\> "/" }  
}  
}  
}  
\</\>

Many thanks for your help!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 19, 2019, 2:59pm UTC](https://discuss.elastic.co/t/logstash-dissect-and-mutate-filter/169042/2 "2019-02-19T14:59:26Z")

</div>

If you want to discard the port number, you could use

```
mutate { gsub => ["someField", "(.*)/.*", "\1"] }

```

If you want to split it then

```
dissect { mapping => { "someField" => "%{ip}/%{port}" } }
```

---

<div class="post-metadata">

**Author:** ![osheap](https://avatars.discourse-cdn.com/v4/letter/o/50afbb/32.png) [@osheap](https://discuss.elastic.co/u/osheap)\
**Post date:** [February 19, 2019, 3:23pm UTC](https://discuss.elastic.co/t/logstash-dissect-and-mutate-filter/169042/3 "2019-02-19T15:23:06Z")

</div>

Thanks Badger, the first statement achieved exactly what I wanted !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2019, 3:23pm UTC](https://discuss.elastic.co/t/logstash-dissect-and-mutate-filter/169042/4 "2019-03-19T15:23:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.