Reputation: 3336
I have the following line:
012018121212XTED11 010FII TRXE CORCI R$ 000000000169000000000017450000000001690000000000172700000000017170000000001717000000000175000051000000000000002011000000000003474670000000000000009999123100000010000000000000BRXTEDCTF006143\r
So i create a filter to extract the price:
grok {
match => ["message", "(?<tipo_registro>.{2})(?<data_pregao>.{8})(?<codbdi>.{2})(?<codneg>.{12})(?<tpmerc>.{3})(?<nomres>.{12})(?<especi>.{10})(?<prazot>.{3})(?<modref>.{4})(?<preabe>.{13})(?<premax>.{13})(?<premin>.{13})(?<premed>.{13})(?<preult>.{13})(?<preofc>.{13})(?<preofv>.{13})"]
}
The price is field preabe, but i need add a dot before two digits to convert to float, so this is my price in string :
00001650
I need add "." , so i will have
000016.50
Now convert to float and i will have
16.50
Any tips ?
Upvotes: 1
Views: 617
Reputation: 16362
Sounds like a job for ruby. Here's some untested code:
filter {
ruby {
code => "event.set('preabe', event.get('preabe').to_i / 100)"
}
}
Upvotes: 1