logstash - split a message by newlines

Question

logstash

trying to split a message by newlines ( "\n" ) with no success so far. I need to retrieve the last line only.

Logstash code:

mutate{
    split => ["traceback", "\n"]
    add_field => {"traceback_last_line" => "%{[traceback][-1]}"}
}

Input:

[traceback] = 
  "File "<doctest...>", line 10, in <module>
    lumberjack()
  File "<doctest...>", line 4, in lumberjack
    bright_side_of_death()
IndexError: tuple index out of range"

Answer 1

I Used gsub to replace '\n' and then, the usual sequence of mutate.split

    mutate {
       copy => { "traceback" => "traceback_tmp" }
    }
    mutate {
       gsub => ["traceback_tmp", "\n", "::"]
    }
    mutate {
       split => {"traceback_tmp" => "::"}
       add_field => ["traceback_summary", "%{[traceback_tmp][-1]}"]
       remove_field => ["traceback_tmp"]
    }