Logstash解析字段问题

Question

i have a log print as follows,

"message" => "....",
"host" => "10.10.12.13",
"@version" => "1",
"@timestamp" => "2016-04-13T01:52:43.535Z",
 "DISMAN-EVENT-MIB::sysUpTimeInstance" => "22 days, 16:33:23.24",
"SNMP-MIB::OID_0" => "example::bgpPeerState",
"source_ip" => "10.10.12.13"

I want to parse the string that is based on the prefix "specific" and add a field for this and remove the original

"SNMP-MIB::OID_0" => "example::bgpPeerState"

it's should looks like as below ,

   "message" => "....",
 "host" => "10.10.12.13",
 "@version" => "1",
 "@timestamp" => "2016-04-13T01:52:43.535Z",
 "type" => "snmptrap",
 "DISMAN-EVENT-MIB::sysUpTimeInstance" => "22 days, 16:33:23.24",
 "example" => "bgpPeerState",
"source_ip" => "10.10.12.13"

my conf,

filter
 {
        if "example" in [SNMP-MIB::OID_0] {
               # I don't how to parse it and add a field  ???

              }
      else
      {
                 .......
       }

}

As always, many thanks for your help!

Answer 1

Use kv filter:

filter {
    if "example" in [SNMP-MIB::OID_0] {
        kv {
            source => "SNMP-MIB::OID_0"
            value_split => ":"
            trim => ":"
            remove_field => "SNMP-MIB::OID_0"
        }
    }
}

}