Would be grateful if someone can point me out to how I can parse a substring. I have this query:
{app="main", event="log"} | tags =~ ".*error.*" | tags !~ ".*connection.*" != "ECONNRESET" | json message="data.message"
Instead of having the entire data.message in message, I'd like to have the first 40 charecters.
How can I do that?
Couldn't find a way to extract a substring
