# Using a slice/partial var in a logstash config?

**URL:** <https://discuss.elastic.co/t/using-a-slice-partial-var-in-a-logstash-config/201559>\
**Category:** Logstash\
**Created:** [September 30, 2019, 3:23am UTC](https://discuss.elastic.co/t/using-a-slice-partial-var-in-a-logstash-config/201559 "2019-09-30T03:23:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![paul\_m](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_m/32/20901_2.png) [@paul\_m](https://discuss.elastic.co/u/paul_m)\
**Post date:** [September 30, 2019, 3:23am UTC](https://discuss.elastic.co/t/using-a-slice-partial-var-in-a-logstash-config/201559/1 "2019-09-30T03:23:45Z")

</div>

Hi there,

We are using %{env} as a way to set what Elasticsearch indices Logstash should post to. We combine this with the application type %{component} to make a namespace

The problem is that some of our log sources set 'env' to the full word 'production/staging/testing', others to just 'prod/stag/test'. How do I set a field to just the first 4 characters of a variable, to maintain some consistency?

```
if [env] and [component] and ![namespace] {
    mutate {
        add_field => { 'namespace' => "%{env}-%{component}" }
    }
}

```

So I'd like to alter the above to use just the first four characters of 'env'. Is there a way to do this inline? Or will I need to make a new variable and use that? My search-fu hasn't been successful (hard to find good terms).

Thanks,

Paul

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 30, 2019, 1:33pm UTC](https://discuss.elastic.co/t/using-a-slice-partial-var-in-a-logstash-config/201559/2 "2019-09-30T13:33:17Z")

</div>

```
mutate { gsub => ["someField", "^(....).*", "\1"] }
```

---

<div class="post-metadata">

**Author:** ![paul\_m](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_m/32/20901_2.png) [@paul\_m](https://discuss.elastic.co/u/paul_m)\
**Post date:** [October 1, 2019, 12:33am UTC](https://discuss.elastic.co/t/using-a-slice-partial-var-in-a-logstash-config/201559/3 "2019-10-01T00:33:38Z")

</div>

Ah, capture groups. My regex blind spot. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2019, 12:33am UTC](https://discuss.elastic.co/t/using-a-slice-partial-var-in-a-logstash-config/201559/4 "2019-10-29T00:33:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.