Strip in mutate filter

Elastic Stack Logstash
1

I have a field in logstash

[user scp -t /apps/user]

I would like to extract the user by doing something similar to stripping off '[' in the string. I saw that the strip option just strips off spaces. So I wanted to know if there is an option to do what I want here. Thanks.

2

You could use either a grok or dissect filter to parse that field.

3

Thank you for the suggestion.. It solved my issue.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.