Strip in mutate filter

I have a field in logstash

[user scp -t /apps/user]

I would like to extract the user by doing something similar to stripping off '[' in the string. I saw that the strip option just strips off spaces. So I wanted to know if there is an option to do what I want here. Thanks.

You could use either a grok or dissect filter to parse that field.

Thank you for the suggestion.. It solved my issue.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.