Replace and Datatype conversion

Elastic Stack Kibana
1

/Folder enumeration completed (6 s)/

This is a sample log. I need to get the number from this string Message. So I tried to split , replace and convert. That didn't work. I tried to create a scripted field first by splitting the token and then converting that field. Didn't work either. Can anyone tell me which is the best way to do this.

2

Hi,

Welcome to this forum! :partying_face:

Do you really need to get the data from within Kibana or would it be possible to parse that while ingesting? While ingesting(either using Elasticsearch ingest pipeline or LogStash pipeline) you can use the following grok pattern: /%{DATA:action} \(%{NUMBER:duration} %{DATA:unit}\)/

This gives you the following result:

{
  "duration": "6",
  "unit": "s",
  "action": "Folder enumeration completed"
}

Best regards
Wolfram

1 Like
3

Thank you so much Wolfram. I was able to change it during ingestion.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.