Logstash substring a field using position

(Samnik60) #1

hi guys,
if i want to extract first 3 characters from a field, how do i go about it.


(Magnus Bäck) #2

I think you need a ruby filter.

ruby {
  code => "event['dest-field'] = event['src-field'][0..2]"

(Samnik60) #3

works thanks a lot. I am trying out logstash for the first time, have many more questions :smile:


This is, indeed, a good solution and worked for me, but not anymore in 5.X.

How's "event['src-field'][0..2]" supposed to look like with the new event API?

What's the correct syntax of substring in 5.X?

(Magnus Bäck) #5


Thank you very much!

(system) #7