Logstash Ruby Code string

Elastic Stack Logstash
1

I am new to this and I am a little stuck.
I have a input from metric beats

"windows" => {
"perfmon" => {
"ica" => {
"output_pn_bandwidth" => 0,
"name" => "ICA-CGP 33 (jgillman)"
}
}

I need to get the user name from the name field. The user name will change it could be jgillman or r.little .... etc
In my logstash conf file I put
mutate {
add_field => { "user" => "%{[windows][perfmon][ica][name]}"}
}

ruby {
    code => "event.set('USER2', event.get('user')[12..30])"
}

the out put that I get is "USER2" => "jgillman)"
the problem is the last ")"
how would I get rid of that?

2

I would not use ruby for that. Instead try

mutate { gsub => [ "user", ".*\((.*)\)", "\1" ] }
3

thanks so much that worked

4

I am new to this could you please explain the code

5

It is .* (anything) followed by a literal (, followed by a capture group () that contains .* (anything), followed by a literal ). That matches the entire string, and the gsub replaces that (the entire string) with \1 (the value of the first capture group, which is everything inside the ( and )).

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.