Grok custom pattern

0
votes

I have the simple message coming in my logstash:

2018-09-30 20:25:07.708  INFO 8013 --- [nio-8443-exec-3] c.e.demo.controller.UsuarioController    : INICIO CHAMADA | 311

I want to remove the following field from this message.

"311"

enter image description here

1
elasticsearchlogstashlogstash-grok

1 Answers

2
votes

You're almost there. You simply need to escape the pipe | character with a backslash (otherwise it matches the 801 after INFO), like this:

: INICIO CHAMADA \| (?<identificador_chamada>[0-9]{3})
                 ^
                 |
             add this

and you'll get this

{
  "identificador_chamada": [
    "311"
  ]
}