Replace substring and concat rest

Elastic Stack Logstash
1

I have DNS Logs looks like

(14)xxxxxxxxxxxx(11)keydelivery(13)mediaservices(7)windows(3)net(0)
(4)mediaservices(7)windows(3)net(0)
(3)windows.com(0)

I want to remove all (...) and replace this with a dot "."
if (..) is in front or end of the string i want to remove it.

Any clever approach without doing that in more steps like first cut the values and then build a new field out of the substrings?

2

Something like this might work:

mutate {
  gsub => [
    "message", "(^\(\d*\))|(\(\d*\)$)", "",
    "message", "\(\d*\)", "."
  ]
}
1 Like
3

Great help, thanks Jenni .... again :wink:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.