Multiple Match Array

Elastic Stack Logstash
1

I am trying to parse a message that will have multiple items that I am trying to capture into an array.

For example :
message: test message @word blah blah @word test ...

In this case, the number of captures can and will be different per message field.

I cannot seem to figure how to capture these specific words that start with an @ symbol.

2

I would do that in ruby

ruby { code => 'event.set("matches", event.get("message").scan(/@\w+/))' }
3

Thanks.

But I will pass on Ruby.

4

Can you expand on your objection to using a ruby filter in logstash?

5

Is that a plugin that has to be installed? I am trying to stay with the native plugins.

6

It is installed by default.

7

Ah ok. I might it whirl then. Thank you sir.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.