Tokenizing using runtime-fields

Elastic Stack Kibana
1

Hello,

I have an ELK index created already with the data value ";<status_code>@ip". I need to define an aggregation based on the status code. Can someone please share any hints to split this 'status_code' from the ELK field using runtime-fields.

Thanks
Venkatesh

2

Hi @rvadiga

I assume your field has all strings that match that pattern ;<status_code>@<ip>.
If that's hold true, then you could write something like this in a runtime_field:

def match = /^;(\d+)@.*$/.matcher(doc['my_field'].value);
if ( match.find() ) {
   emit(match.group(1));
}
3

Thanks Marco. Your suggestions is a great help for my task.

4
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.