Modify field content

I need to add new field at logstsh !
the original field is request content "/example/example/example/getMessageList.json?_t=1512453462541" , now I don't need "?_t=1512453462541"
so how to do it ?

config is:

mutate {
add_field => { "path" => "%{request}" }
mutate {
split => { "path" => "?" }

I suggest a mutate filter with a gsub option. You can delete everything from the question mark until the end of the string.

Dear Sir:
Your suggest already helped me !! my problem got the answer!!
thank you so much !!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.