Logstash grok for change field value

Elastic Stack Logstash
1

Hi,
I just wanna change my field value like this:

I have a log json with field:
"source_host": "dev-host-test.com.pl",

and i need to remove only .com.pl leave the old field and create new field with value:
"new_field":"dev-host-test"

Is there a simple way to do it with grok or other logstash options ?

2

Try something like this:

dissect {
  mapping => {
    "source_host" => "%{new_field}.%{}"
  }
}
3

Yeah this solution work, but :slight_smile: i have mixing source_host values like:

  • dev-host-test
  • dev-host-test2.com.pl
    etc

And i think this solution work only for message that have .com.pl , if message has correct value: only dev-host-test and i dont need to change anything i got an error:

[2019-02-05T09:29:14,315][WARN ][org.logstash.dissect.Dissector] Dissector mapping, pattern not found {"field"=>"source_host", "pattern"=>"%{index_field}.%{}",
4

Then you might need a conditional as well to check if the field contains a dot.

5

Simple if ? like:

if ("*." in [source_host]) {
dissect {
  mapping => {
    "source_host" => "%{source_host}.%{}"
  } 
 }
}
6

Maybe something like this:

  if [source_host] =~ /\./ {
    dissect {
      mapping => {
        "source_host" => "%{new_field}.%{}"
      }
    }
  } else {
    mutate {
      copy => { "source_host" => "new_field" }
    }
  }
1 Like
7

Works perfectly <3 ! Thanks so much!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.