Query on Grok & Mutate plugins with Logstash


I am trying to match a pattern ES document which is being ingested via Logstash.
Pattern is duration defined in hours like PT(Hours)H.
I am using following as part of the logstash conf but I don't see any fields being added to the document and don't see anything in the logs as well.
Can you please let me know what am I missing here?

  match => [ "message", "PT%{NUMBER:DurationHours}H" ]

add_field => { "NewDurationHrs" => "%{DurationHours}" }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.