Truncation of field values in grok filter

[Rupesh_Ranjan]

How can i truncate a field value in grok?

e.g. I have a field "value: abcdefgh1234567890" in logstash(obtained from message after grok filter)

match => { "message" => "%{GREEDYDATA}value=%{WORD:value}"}

and i want to truncate value to show only 5 chracters and append xxxxx for rest, so the value i want to send to elasticsearch will be "value: abcdexxxxxxxxxxxxx".

[paz]

I don't think you can do that in grok, you probably need some custom ruby code after your grok filter, like:

filter {
    ruby {
        code => "
            event.set('value', event.get('value')[0..4] + ('x' * (event.get('value').length - 6)))
        "
    }
}