Logstash: regex to get part of file name

Elastic Stack Logstash
1

Hi,

I am trying to get the date in the file name using following regex, but it still return a-zA-Z character:

Path:
/home/appadmin/Documents/ML/data/pocket_pmo/activityLogs20201211.csv

grok { match => { "path" => "(?<[@metadata][indexName]>[^/][\d]*)....$" } }
mutate {
add_field => {"indexname" => "%{[@metadata][indexName]}" }
}

result:

"indexname" => "s20201211"

May i know why the character 's' still there? How do i get only the date ?

Regards.

2

"(?<[@metadata][indexName]>[^/][\d]*) captures a single character that is not slash (i.e. the 's'), followed by zero or more digits. You already have the pattern anchored to the end of the string, and I see no reason to include the [^/].

3

If i remove [^/] to become the following:

grok { match => { "path" => "(?<[@metadata][indexName]>[\d]*)....$" } }

i got the following results:

"indexname" => "%{[@metadata][indexName]}"

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.