I wonder if someone can help. I have looked online and I haven't found a solution. We have an event that passes a message like "error detected in request error code: [error code] please check"
Is there a way to be able to tell logstash to look for error detected and create a new field and populate with the name error code and the value of [error code].
I have used the Dissect filter to split the message into different fields which has worked however the way the message has been written it reads
Error : Client Id - 1 : Error Code - 2 : Description : Error has occurred : Employee ID - 1
When using the dissect I have the following mapping "%{error}: %{company id} : %{Error Code} : %{Error Description}: %{Employee Id}"
is there a way to say for the company ID and error code I want the value after the - but in the Description i would like the value after the first : then a new field for employee id?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.