Hello,
I have a string field named hostname, when the user have multiple instances I am getting an index in this field.
For example hostname looks like: toto1940,toto1941,toto1942.
I would like to remove the last element of my field and getting only toto194
Thanks for help
If that is a string you could do it using
dissect { mapping => { "message" => "%{host}0,%{}" } }
Thank you Badger,
I resolved it by using ruby:
ruby { code => " event.set('myhostname', event.get('hostname')[0..-2]) " }
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.