<MCC> specify what is the name of the new field. The name is followed by a pattern [0-9]{3}. [0-9] specify what i search. Here i search digit between 0 and 9 include. {3} specify the number of digit i want to find. Here 3.
For each new field, i copy past the first configuration and change the name of the field and the number of digit i search.
The final grok filter looks like this:
grok {
match => { "CGI" => "(?<MCC>[0-9]{3})(?<MNC>[0-9]{2})(?<LAC>[0-9]{5})(?<CellID>[0-9]{5})" }
}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.