Is there a valid function in logstash "add field" to strip a hostname to a part of it.
i have variations of hostnames from a haproxy.log like this
- cccrz1-qa01.exserver.int
- cccrz2-qa01.exserver.int
- preaccccrz1-qa01.exserver.int
- preaccccrz2-qa01.exserver.int
- conaccccrz1-qa01.exserver.int
- conaccccrz2-qa01.exserver.int
and want to add the information "ccc" from it to an additional field.
- preac/conac prefixes
and
- rz1/rz2-qa/dev/live.ex.server.int
are mandatory parts of the hostnames. At the end i dont want to mess with the haproxy grok pattern