I have a field which is like "host":{"name":"abcdef"}, How can i get the value "abcdef" alone from the host field? gsub is not allowing me to remove the {} or "name":
I tried to get the value by referencing as %{host}{name}. That does not work too.
I have a field which is like "host":{"name":"abcdef"}, How can i get the value "abcdef" alone from the host field? gsub is not allowing me to remove the {} or "name":
I tried to get the value by referencing as %{host}{name}. That does not work too.
Maybe %{[host][name]}
Thank you very much. It worked.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.