CODEWITHSUNDEEP
elasticsearchlogstashlogstash-grok
Rafael Augusto
Rafael Augusto

Reputation: 797

Grok custom pattern

I have the simple message coming in my logstash:

2018-09-30 20:25:07.708  INFO 8013 --- [nio-8443-exec-3] c.e.demo.controller.UsuarioController    : INICIO CHAMADA | 311

I want to remove the following field from this message.

"311"

enter image description here

Upvotes: 0

Views: 130

Answers (1)

Val
Val

Reputation: 217304

You're almost there. You simply need to escape the pipe | character with a backslash (otherwise it matches the 801 after INFO), like this:

: INICIO CHAMADA \| (?<identificador_chamada>[0-9]{3})
                 ^
                 |
             add this

and you'll get this

{
  "identificador_chamada": [
    "311"
  ]
}

Upvotes: 2

Related Questions