ok i did it with grok but i when i have another value in another line in the same message i mean like this:
2022-01-01 17:17:13 - id alex =>00011223344556677
2022-01-01 17:18:15 - number =>00335566221144
i did this but didnt work, when i tried in dev tools Grok debugger it works:
filter {
if ("id alex" in [message] and "number" in [message]) {
grok { match => { "message" => "(?<id>^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s{3}-\sid\salex\sis\s\S{2}*)(\r\n|\r|\n)(?<number>^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s{3}-\snumber\sis\s\S{2}*)
" } }
}
I would like to know what is the problem. because I don't get any error.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.