Adding fields based on match

Elastic Stack Logstash
1

Hi All,
I have the following scenario:
1 index containing json fields.
I need to match Event1_fieldA to Event2_fieldB.
If there is a match, add additional existing field from Event2 to Event1.
How would I achieve this?
Do I have to use logstash?
I tried playing with the aggregate filter but got nothing useful.
This is what I have so far:

if [somefield] == "somevalue" {
aggregate {
     task_id => "%{[fieldA][fieldB]}"
   code => "
     map['Test'] = event.get('additional existing field in Event2')
   "
   map_action => "create"
   end_of_task => true
   timeout => 3

 }    
 }

Any help would be greatly appreciated.

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.