I want to transform 18 digit numbers into 15 digit by dropping last 3 digits. Could someone please guide me for that?
Props.conf
[weblog]
TRANSFORMS = numbers
Transforms.conf
[numbers]
SOURCE_KEY = _raw
REGEX = xxxx\"\:\d+
FORMAT = \d{15}
I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:
<timestamp> some text here number=123456789012345678
You want to extract the first fifteen digits? You could do this in props.conf:
[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})
If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:
[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)
That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely.
I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:
<timestamp> some text here number=123456789012345678
You want to extract the first fifteen digits? You could do this in props.conf:
[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})
If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:
[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)
That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely.