Modify field content

Elastic Stack Logstash
1

I need to add new field at logstsh !
the original field is request content "/example/example/example/getMessageList.json?_t=1512453462541" , now I don't need "?_t=1512453462541"
so how to do it ?

config is:

mutate {
add_field => { "path" => "%{request}" }
}
mutate {
split => { "path" => "?" }
}

2

I suggest a mutate filter with a gsub option. You can delete everything from the question mark until the end of the string.

3

Dear Sir:
Your suggest already helped me !! my problem got the answer！！
thank you so much !!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.