Hello !
I am in complete stuck in some dealing with Logstash.
There is a non-structured information gotten from one source , divided by \n char
I cut it out in input section into set of messages with the multiline codec .
So I get the information before filtering looks like it :
message: "Block1"
message: " Attribut1:Value1"
message: " Attribut2:Value2"
message: " Attribut3:Value3"
message: "\r"
message: "Block2"
message: " Attribut12:Value11"
message: " Attribut23:Value21"
message: " Attribut33:Value34"
message: "\r"
I'd like to merge that messages into something similar to
message: {Block1:["Attribut1:Value1" ," Attribut2:Value2"," Attribut3:Value3" ]}
message: {Block2:["Attribut12:Value11" ," Attribut23:Value21"," Attribut33:Value34" ]}
but I am not able to find a way how to do it properly. Neither aggregate nor grok seems to me could play in my case. Wouldn't you be so kind to show me how to deal with it ?