Add data to aggregate from a log line with no specific task_id

Elastic Stack Logstash
1

Excuse me everyone,

Given the following events:

event1 = {
  "queueid" => "ABC1234",
  "process" => "qmgr",
  "from" => "sender@domain.com"
}

event2 = {
  "queue_id" => "ABC1234",
  "process" => "smtp",
  "to" => "recipient@domain.com",
  "messageid" => "1517305644.29809.1@Organization"
}

event3 = {
  "process" => "spamd",
  "messageid" => "1517305644.29809.1@Organization",
  "spam_result" => "Yes"
}

Would it be possible to aggregate them into something like this?:

finalEvent = {
  "queueid" => "ABC1234",
  "from" => "sender@domain.com",
  "to" => "recipient@domain.com",
  "messageid" => "1517305644.29809.1@Organization",
  "spam_result" => "Yes"
}

I'm being able to aggregate the first two events by using 'queueid' as task_id, but I'm not sure if it would be possible to add info from event3 to it based on it's 'messageid' field.

Thanks in advance!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.