title: how to extract a portion of a field and store it into another field in logstash filter?
body: <p>I have syslog files. I am using logstash syslog plugin filter to process those logs. I am getting messages in the <code>syslog_message</code> field like this one:</p>
  
  <pre><code>syslog_message:[cdp/interface.ERR] - {- -} Error writing CDP frame on system. Link is down
  </code></pre>
  
  <p>But I want a new field which should contain only the portion before .ERR i.e "cdp/interface". This portion varies and I dont know how many types will occur.
  So I want a new field and want to store that portion on to that field, so that I can plot count of those terms in kibana. </p>
  
  <p>current logstash configuration: </p>
  
  <pre><code>filter {
    if [type] == "syslog" {
      grok {
        match =&gt; { "message" =&gt; "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
        add_field =&gt; [ "received_at", "%{@timestamp}" ]
        add_field =&gt; [ "received_from", "%{host}" ]
  
      }
      date {
        target =&gt; "syslog_timestamp"
        match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
      }
  </code></pre>
  
  <p>After adding a new grok to configuration file as suggested by @Val</p>
  
  <pre><code>grok {
    match =&gt; { "syslog_message" =&gt; "\[%{PROG:syslog_type}\.%{LOGLEVEL:syslog_level}\] %{GREEDYDATA:syslog_message}" }
  }
  </code></pre>
  
  <p>For some of the inputs grokparsefailure happens.<br>
  Some lines for which it fails are :</p>
  
  <pre><code>syslog_message: [hald.INFO]: Support query handler called
  syslog_message:[mgmtd.INFO]: Finished database commit
  </code></pre>
  
  <p>Any help will be appreciated.
  Thanks</p>