自定义模式

Question

I have the simple message coming in my logstash:

2018-09-30 20:25:07.708  INFO 8013 --- [nio-8443-exec-3] c.e.demo.controller.UsuarioController    : INICIO CHAMADA | 311

I want to remove the following field from this message.

"311"

Answer 1

You're almost there. You simply need to escape the pipe | character with a backslash (otherwise it matches the 801 after INFO ), like this:

: INICIO CHAMADA \| (?<identificador_chamada>[0-9]{3})
                 ^
                 |
             add this

and you'll get this

{
  "identificador_chamada": [
    "311"
  ]
}