Split and Substring

Elastic Stack Logstash
1

Hello guys,
I have a group of strings like "lorem","ipsum", i wanna only "um" part of the string
how i can do it

i tried mutate filter and split, split give me array but i need last two char of the array
filter {
mutate {
split => ["message",","]
add_field => {"[@metadata][mykey]" => "%{[message][1]}"} //but i need [message][1][..2]
}
}

2 
mutate { gsub => [ "[@metadata][mykey]", ".*(..)$", "\1" ] }
3

can not working or idk how to append this code.

4

What do you get from

output { stdout { codec => rubydebug } }

for a sample message?

5

input {
udp {
port => xxxx
}
}

filter{
mutate {
split => ["message",","]
add_field => {"[@metadata][mkey]" => "%{[message][1]}"}
# try to get last 2 char
}
}

output {
kafka {
codec => plain { format => '{"ip":"%{host}", "msg":"%{message}", "test":"%{[@metadata][mkey]}"}'}
topic_id => "test"
message_key => "%{[@metadata][mkey]}"
}
}

6

haven't any error but i get message from string %{[@metadata][mkey] not "um"

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.