Add_field with value from message

Elastic Stack Logstash
1

Hi,
filebeat.yml:

  multiline.type: pattern
  multiline.pattern: '^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s{3}-\sStarting'
  multiline.negate: true
  multiline.match: after
  multiline.max_lines: 140

So in my message field now i have a block of lines like I did. I just want when I found the word "id alex" for example add a field
example line in my message:

2022-01-01 17:17:13   - id alex =>00011223344556677

but i want in this new field to display the value of this "id alex" that means i want "00011223344556677" as value

Any help would be sincerely appreciate!
Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.