Substring a field from Logstash

Elastic Stack Logstash
1

I want create a new field based on an field from an JDBC input
i want to use the filter option of Logstash but not sure the how to.

My goal is to have something like this:

new_field = substr(old_field,1,300)
i want to extract the first 300 characters of the old field using for example the Grok filter...

How'd do that ?

2

I found the solution:

ruby {
code => "event['dest-field'] = event['src-field'][0..2]"
}

Credit to Magnus Bäck

3

In any version of logstash from recent years you will need to use event.get and event.set rather than refering to event as a hash.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.