Regular Expression on Env Var

  - add_fields:
        custom_value: "${COMPUTERNAME}"

Is it possible to use regex on {COMPUTERNAME} to only return the first X characters or last X characters? I tried adding the above processor then adding a truncate with max of X characters but it didn't work. ^.{5} would technically match on the first 5 characters - is there a way to have WinLogBeat look at the {COMPUTERNAME} env var and run the regex pattern against it and use that value in custom_value (or any other field name)

Instead of using ${COMPUTERNAME} I was ableto copy field then truncate it using max_character property to achieve the desired end result.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.