Logstash: regex to get part of file name


I am trying to get the date in the file name using following regex, but it still return a-zA-Z character:


grok { match => { "path" => "(?<[@metadata][indexName]>[^/][\d]*)....$" } }
mutate {
add_field => {"indexname" => "%{[@metadata][indexName]}" }


"indexname" => "s20201211"

May i know why the character 's' still there? How do i get only the date ?


"(?<[@metadata][indexName]>[^/][\d]*) captures a single character that is not slash (i.e. the 's'), followed by zero or more digits. You already have the pattern anchored to the end of the string, and I see no reason to include the [^/].

If i remove [^/] to become the following:

grok { match => { "path" => "(?<[@metadata][indexName]>[\d]*)....$" } }

i got the following results:

"indexname" => "%{[@metadata][indexName]}"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.