Split header param and convert the value to a number

grok {
match => {
"message" => "^%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel}%{SPACE}%{NOTSPACE:class}%{SPACE}(%{DATA:thread})%{SPACE}%{DATA:linenumber}%{DATA:txnid}%{NUMBER:eventID}%{DATA:eventName}%{DATA:componentid}%{IP:clientip}%{DATA:is_key_value}%{DATA:log_msg}$"

I have this filter, and here I have linenumber field as "LINE:234", I want to take only the value and make it a number and proceed. Hence the output would be just 234 as in Number type.

How can I achieve this?

I would replace %{DATA:linenumber} with LINE:%{NUMBER:linenumber:int}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.