Modify the content of a field using logstash

问题

I am using logstash to get data from a sql database. There is a field called "code" in which the content has this structure:

PO0000001209

ST0000000909

And what I would like to do is to remove the 6 zeros after the letters to get the following result:

PO1209

ST0909

I will put the result in another field called "code_short" and use it for my query in elasticsearch. I have configured the input and the output in logstash but I am not sure how to do it using grok or maybe mutate filter

I have read some examples but I am quite new on this and I am a bit stuck.

Any help would be appreciated. Thanks.

回答1:

You could use a mutate/gsub filter for this but that will replace the value of the code field:

filter {
  mutate {
    gsub => [
      "code", "000000", "",
    ]
  }
}

Another option is to use a grok filter like this:

filter {
  grok {
    match => { "code" => "(?<prefix>[a-zA-Z]+)000000%{INT:suffix}" }
    add_field => { "code_short" => "%{prefix}%{suffix}"}
  }
}

来源：https://stackoverflow.com/questions/41958787/modify-the-content-of-a-field-using-logstash