Hi guys,
I'm trying to add data in a field like an array, but my grok or mutate overwrites it, could someone take a look?
This is my code:
`filter {
if [message] =~ "TargetID:" {
drop{}
}
grok {
patterns_dir => ["/usr/share/logstash/patterns"]
break_on_match => false
match => {
"message" =>[
"%{DATESTAMP:timing}",
"%{FIRSTLINE:firstline}",
"%{EVENTPD:eventpd}"
]
}
tag_on_failure => []
}
if [firstline]{
grok {
break_on_match => true
match => ["firstline","%{WORD:test}\s%{WORD:test}\s%{WORD:test}\s%{WORD:test}\s%{WORD:test}\s\[%{USERNAME:sessionId}\]\s%{WORD:test}\s%{WORD:test}\s%{WORD:test}\s\[\[%{WORD:eventCodetmp}"]
}
mutate{
#remove_field => ["firstline"]
remove_field => ["message"]
remove_field => ["@version"]
remove_field => ["timing"]
remove_field => ["test"]
add_field => ["eventCode" , "%{eventCodetmp}"]
#remove_field => ["eventCodetmp"]
rename => {"@timestamp" => "timestamp"}
rename => {"timing" => "startTime"}
}
}
date
{
locale => "es"
match => ["startTime","dd/MM/YY HH:mm:ss.SSS", "ISO8601"]
timezone => "Europe/Vienna"
target => "startTime"
}
if [eventpd]{
grok {
break_on_match => true
match => ["eventpd","SessionID\:\s%{USERNAME:sessionId}\]\s\#\#\#\sEvent\s\[%{WORD:eventCodetmp1}"]
}
mutate{
#remove_field => ["eventpd"]
remove_field => ["message"]
remove_field => ["@version"]
remove_field => ["timing"]
add_field => ["eventCode" , "%{eventCodetmp1}"]
#remove_field => ["eventCodetmp"]
rename => {"@timestamp" => "timestamp"}
rename => {"timing" => "startTime"}
}
}
} `
The tmp variables are being fill with correct data, but always, when eventpd happends it overwrite the value of eventCode instead of add the value as array
