# Substring a field from Logstash

**URL:** <https://discuss.elastic.co/t/substring-a-field-from-logstash/217990>\
**Category:** Logstash\
**Created:** [February 5, 2020, 12:46pm UTC](https://discuss.elastic.co/t/substring-a-field-from-logstash/217990 "2020-02-05T12:46:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Haalanam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haalanam/32/58782_2.png) [@Haalanam](https://discuss.elastic.co/u/Haalanam)\
**Post date:** [February 5, 2020, 12:46pm UTC](https://discuss.elastic.co/t/substring-a-field-from-logstash/217990/1 "2020-02-05T12:46:43Z")

</div>

I want create a new field based on an field from an JDBC input  
i want to use the filter option of Logstash but not sure the how to.

My goal is to have something like this:

new\_field = substr(old\_field,1,300)  
i want to extract the first 300 characters of the old field using for example the Grok filter...

How'd do that ?

---

<div class="post-metadata">

**Author:** ![Haalanam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haalanam/32/58782_2.png) [@Haalanam](https://discuss.elastic.co/u/Haalanam)\
**Post date:** [February 5, 2020, 1:18pm UTC](https://discuss.elastic.co/t/substring-a-field-from-logstash/217990/2 "2020-02-05T13:18:56Z")

</div>

I found the solution:

ruby {  
code =\> "event['dest-field'] = event['src-field'][0..2]"  
}

Credit to [Magnus Bäck](https://discuss.elastic.co/u/magnusbaeck)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 5, 2020, 5:31pm UTC](https://discuss.elastic.co/t/substring-a-field-from-logstash/217990/3 "2020-02-05T17:31:40Z")

</div>

In any version of logstash from recent years you will need to use event.get and event.set rather than refering to event as a hash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2020, 5:31pm UTC](https://discuss.elastic.co/t/substring-a-field-from-logstash/217990/4 "2020-03-04T17:31:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.