Parsing underscore

[rbeg (regis beguin)]

Hello,

Can you help me please?
I need to parse this field in logstash filter :

word1_word2_word3_word4

And I want to put word3 into a new field named my_field.

How to do this please?

I try with grok and regular expression.

Thanks

[Wolfram_Haussig]

Hello Regis,

Can you post us which grok you have tried? Maybe we can help you with finding the error.

Best regards
Wolfram

[rbeg (regis beguin)]

I found a solution with this :

([0-9a-zA-Z])(_)([0-9a-zA-Z])(_)(?<my_field>[0-9a-zA-Z]*)