logstashlogstash-filter

Logstash substring a field using position using mutate


I wonder if there is a way of using a substring when using add_field in mutate filter, maybe with %{field} syntax.
For example:

filter {
    mutate {
        add_field => { "shorter_field" => "%{field[0:4]}" }
    }
}

I saw solutions using ruby filters, but I prefer only using mutate because I have a sequence of operation I'm doing using the filter and I prefer keeping it simple


Solution

  • Try this:

    (assuming that you need first 4 characters of the field.)

    CODE:

    filter {
        mutate {
            gsub => ["shorter_field", "(?<=^....)(.*)", ""]
        }
    }
    

    In here all characters except first 4 characters will be removed from shorter_field.

    example:

    INPUT:

    shorter_field = example_value
    

    OUTPUT:

    shorter_field = exam