Logstash substring a field using position using mutate

Question

I wonder if there is a way of using a substring when using add_field in mutate filter, maybe with %{field} syntax.
For example:

filter {
    mutate {
        add_field => { "shorter_field" => "%{field[0:4]}" }
    }
}

I saw solutions using ruby filters, but I prefer only using mutate because I have a sequence of operation I'm doing using the filter and I prefer keeping it simple

Answer 1

Try this:

(assuming that you need first 4 characters of the field.)

CODE:

filter {
    mutate {
        gsub => ["shorter_field", "(?<=^....)(.*)", ""]
    }
}

In here all characters except first 4 characters will be removed from shorter_field.

example:

INPUT:

shorter_field = example_value

OUTPUT:

shorter_field = exam