Logstash substring a field using position


(Samnik60) #1

hi guys,
if i want to extract first 3 characters from a field, how do i go about it.

Thanks,
sam


(Magnus Bäck) #2

I think you need a ruby filter.

ruby {
  code => "event['dest-field'] = event['src-field'][0..2]"
}

(Samnik60) #3

works thanks a lot. I am trying out logstash for the first time, have many more questions :smile:


#4

This is, indeed, a good solution and worked for me, but not anymore in 5.X.

How's "event['src-field'][0..2]" supposed to look like with the new event API?
https://www.elastic.co/guide/en/logstash/current/event-api.html

What's the correct syntax of substring in 5.X?


(Magnus Bäck) #5
event.get('src-field')[0..2]

#6

Thank you very much!


(system) #7