Regular Expression on Env Var

Elastic Stack Beats
1 
processors:
  - add_fields:
    fields: 
        custom_value: "${COMPUTERNAME}"

Is it possible to use regex on {COMPUTERNAME} to only return the first X characters or last X characters? I tried adding the above processor then adding a truncate with max of X characters but it didn't work. ^.{5} would technically match on the first 5 characters - is there a way to have WinLogBeat look at the {COMPUTERNAME} env var and run the regex pattern against it and use that value in custom_value (or any other field name)

2

Instead of using ${COMPUTERNAME} I was ableto copy host.name field then truncate it using max_character property to achieve the desired end result.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.