hi ..I am new to ELK stack . I want to create a new filed from a existing field created by logstash at the time of parising , by painless scripting.
this is my "request" field => "/gameserver_pkr?websocket=1&&action=update_score"
I want to have a substring from index 0 to index of "?".
I have appended => script.painless.regex.enabled: true into elasticsearch.yml file.
Can anyone help ?
scripted field code is->
def String p = doc['request'].value;
Def String App = p.subString(0, p.indexOf ('?'));