Mutate filter a word between quotes


I want to create a filter in a logstash configuration with a word between quotation marks. Something like this "word":"1234567890"

I want to mutate this part of the log message so I can create a new field for the phrase after de colon, but without the quotation marks. Something like this 1234567890.

My problem is how I can create a mutate filter so I split this part of the log so I get the goal.

I try something like this

mutate {
split => {"log_tmp" => "\"Word\""}

I find searching that with this expression \" quotation mark is treated as a part of the text. But it seems didn't work.

Please help :pray:

Thank you.

How about this?

grok { match => { "message" => '"word":"%{NUMBER:n}"' } }

Mmmm :thinking:

I will try it and let you know.

Thank you.

Works very well.

Thank you.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.