How to remove text after a specific word in message in logstash using grok and gsub

Question

"0x10022924 0x1027b06c 0x1027b118 0x1003c0 0xf99f358 0xf9a4040 0xf99f440 0x10281580 0x1027e964 0x100419e0 0x10041c04 0x10047d38 0x10052c5c 0x1007274c 0xfe88b08 0xfa372a8 Crash Debug Info: airvCellStartRcvdTime_g = 0.000000000 airvCellStopDelRcvdTime_g = 0.000000000 Crash time at

I want drop everything starting form Crash

Answer 1

To check basic GROK expression against your logs use this website: GrokConstructor. For your data The required expression will be

^%{DATA:clientip} Crash %{GREEDYDATA:response}

where in response you will get the desired output:

Debug Info: airvCellStartRcvdTime_g = 0.000000000 airvCellStopDelRcvdTime_g = 0.000000000 Crash time at