Logstash extract part of field

Elastic Stack Logstash
1

Dears,

ELK in version 7.16.3

What is the best way to extract part of mapped xml field to new field?

  if "app1xml" in [tags] {
  xml {
    source => "message"
    store_xml => false
    force_array => false
    xpath => [
      "/log//msg/field[@id='2']/@value", "app.source_field",

    ]
  }
  }

example field looks like:

      <field id="2" value="5350621360940215"/>

and I need only four first signs.

5350

Best Regards,
Dan

2

Hello,

Can you try using substring?

"substring(/log//msg/field[@id='2']/@value, 0, 4)", "app.source_field"
3

@adrianfusco

Works well. Thanks a lot.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.