Transforming 18 digit numbers into 15 digits

[satishsdange]

I want to transform 18 digit numbers into 15 digit by dropping last 3 digits. Could someone please guide me for that?
Props.conf

[weblog]
TRANSFORMS = numbers

Transforms.conf

[numbers]
SOURCE_KEY = _raw
REGEX = xxxx\"\:\d+
FORMAT = \d{15}

[martin_mueller · Accepted solution]

I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:

<timestamp> some text here number=123456789012345678

You want to extract the first fifteen digits? You could do this in props.conf:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})

If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)

That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely.