Mutate filter a word between quotes

Elastic Stack Logstash
1

Hi.

I want to create a filter in a logstash configuration with a word between quotation marks. Something like this "word":"1234567890"

I want to mutate this part of the log message so I can create a new field for the phrase after de colon, but without the quotation marks. Something like this 1234567890.

My problem is how I can create a mutate filter so I split this part of the log so I get the goal.

I try something like this

mutate {
split => {"log_tmp" => "\"Word\""}
}

I find searching that with this expression \" quotation mark is treated as a part of the text. But it seems didn't work.

Please help :pray:

Thank you.

2

How about this?

grok { match => { "message" => '"word":"%{NUMBER:n}"' } }
3

Mmmm :thinking:

I will try it and let you know.

Thank you.

4

Works very well.

Thank you.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.