Logstash name fields

Elastic Stack Logstash
#1

i have a field, the field format looks like

A-B-C::E_[randomNum]
the field is dynamic because the randonNUM , i want to change the '-' to '_' and remove the [randomNUM] and it's will be looks like as follow,

A-B-C::E

Is there any plugin / strategy to solve this problem?
any help will be appreciated !

#2

The mutate plugin will solve your problem, using regex replacement :

mutate {
  gsub => [ "message", "_[0-9]+", "" ]
}

mutate {
  gsub => [ "message", "[-]", "_" ]
}
#4

OK, so this pattern is "fieldname". I believed it was field value.

It is weird like field name.
Is the original field name generated by logstash, or do you get it like that from an external source ?

If it is first option, I invite you to generate at the beginning the wished field name.
Because, after, you can't do it without using ruby filter and write code which mutates event.

#6

OK.

It is weird like field name.
Is the original field name generated by logstash, or do you get it like that from an external source ?

#7