Logstash substring a field using position

[samnik60]

hi guys,
if i want to extract first 3 characters from a field, how do i go about it.

Thanks,
sam

[magnusbaeck (Magnus Bäck)]

I think you need a ruby filter.

ruby {
  code => "event['dest-field'] = event['src-field'][0..2]"
}

[samnik60]

@magnusbaeck

ruby {
code => "event['dest-field'] = event['src-field'][0..2]"
}

works thanks a lot. I am trying out logstash for the first time, have many more questions

[Kvin]

This is, indeed, a good solution and worked for me, but not anymore in 5.X.

How's "event['src-field'][0..2]" supposed to look like with the new event API?
https://www.elastic.co/guide/en/logstash/current/event-api.html

What's the correct syntax of substring in 5.X?

[magnusbaeck (Magnus Bäck)]

event.get('src-field')[0..2]

[Kvin]

Thank you very much!