Remove part of a field

Elastic Stack Logstash
#1

Hi,

I'm working with phone numbers, i would like to save the 2 or 3 first digit of a phone number ( international code) .

Actually i have a field "called_number", how can i save the 2 or 3 first digit in another field ? some country have 2 digit, some others have 3 digits.

Thx

#2

Use a grok filter to extract the first few digits.

#3

could you help me to built that grok ?

#4

I just discover that some country prefix has 1 digit, 2 digit, 3 digit or 6 digit.

i would like to base on that tutorial: http://www.sanjeevnandam.com/blog/logstash-convert-zipcodepostal-code-to-geo_point-latitudelongitude

but i suppose a have do do multiple check ?

#5