title: Is it possible to extract a certain part of a string field and cast it to some other type?
body: <p>I have a <code>file</code> input in logstash, which reads from <code>/var/log/syslog</code>. The log message goes into <code>message</code> field. I didn't think about extracting some parts of the message beforehand, but now I would like to find all entries with the <code>message</code> field that have a word <code>WORD</code> in them and extract a number from that string, and I would like to feed that number to Kibana to build a line chart based on it.</p>
  
  <p>More concretely: messages look like this:</p>
  
  <pre><code>{
    //... timestamp, id etc
    "message" : "User used WORD approximately 10 times"
    //
  }
  </code></pre>
  
  <p>I would like to have:</p>
  
  <pre><code>{
    // timestamp, ...
    "message" : 10
  }
  </code></pre>
  
  <p>Is it possible without some really blunt force? The worst thing I can imagine is to re-feed all the messages through the new logstash input which will structure the messages, but that looks like a really bad approach.</p>