Parsing out text from a string using a logstash filter -

i have apache access log parse out text within request field:

get /foo/bar?contentid=abc&_=1212121212 http/1.1" 

what extract , assign 12121212122 value value based off of prefix abc&_ (so think need if statement or something). prefix take on other forms (e.g., ddd&_)

so say

if (prefix == abc&_)    abcid = 1212121212 elseif (prefix == ddd&_)    dddid = <whatever value> else    nothing 

i have been struggling build right filter in logstash extract id based on prefix. great.

thank you

for use grok filter.

for example:

artur@pandaadb:~/dev/logstash$ ./logstash-2.3.2/bin/logstash -f conf2 settings: default pipeline workers: 8 pipeline main started /foo/bar?contentid=abc&_=1212121212 http/1.1" {        "message" => "get /foo/bar?contentid=abc&_=1212121212 http/1.1\"",       "@version" => "1",     "@timestamp" => "2016-07-28t15:59:12.787z",           "host" => "pandaadb",         "prefix" => "abc&_",             "id" => "1212121212" } 

this sample input, parsing out prefix , id.

there no need if here, since regular expression of grok filter takes care of it.

you can (if need put in different fields) analyse field , add different one.

this output that:

get /foo/bar?contentid=abc&_=1212121212 http/1.1" {        "message" => "get /foo/bar?contentid=abc&_=1212121212 http/1.1\"",       "@version" => "1",     "@timestamp" => "2016-07-28t16:05:07.442z",           "host" => "pandaadb",         "prefix" => "abc&_",             "id" => "1212121212",          "abcid" => "1212121212" } /foo/bar?contentid=ddd&_=1212121212 http/1.1" {        "message" => "get /foo/bar?contentid=ddd&_=1212121212 http/1.1\"",       "@version" => "1",     "@timestamp" => "2016-07-28t16:05:20.026z",           "host" => "pandaadb",         "prefix" => "ddd&_",             "id" => "1212121212",          "dddid" => "1212121212" } 

the filter used looks that:

filter {     grok {         match => {"message" => ".*contentid=%{greedydata:prefix}=%{number:id}"}      }      if [prefix] =~ "abc" {          mutate {             add_field => {"abcid" => "%{id}"}          }     }      if [prefix] =~ "ddd" {          mutate {             add_field => {"dddid" => "%{id}"}          }     }  } 

i hope illustrates how go it. can use test grok regex:

http://grokdebug.herokuapp.com/

have fun!

artur