Logstash - REGEX to change a field

Elastic Stack Logstash
1

Hello,

I'm receiving snmptraps from an equipement with a sequence ID at the end. The sequence ID increase at every new trap. This is normaly considered as a new field and after a while the max of field is reached and I can't store no more logs

image
image694×101 24.8 KB

So in my mind, I need to add a filter with a REXGEX code to delete the end of OID (the sequence ID ). Can you let me know how to do that ?

The REGEX should be .[^.]*$

Thanks

2

If you want to change field names using a regexp then you have to use ruby. You could try something like this (not tested):

ruby {
    code => '
        event.to_hash { |k, v|
            if k =~ /1\.1\.1/ # I'm sure you can do better than this
                newK = k.sub(/.[^.]+$/)
                event.set(newK, v)
            end
        }
    '
}