Hello..
I have a trouble making 1 log with 2 events.
1521537121385|172.16.130.205|First
1521537121385|172.16.130.205|Second
1521537121386|172.16.130.205|Third
(LastSessionTime)(SrcIP)(ExtractedText)
Then i want to make combined log (ExtractedText + ExtractedText ==> FullContent)
==>
1521537121385|172.16.130.2015|FirstSecond
aggregate{
task_id => "%{LastSessionTime}"
code => "
map['LastSessionTime'] = event.get('LastSessionTime')
map['FullContent'] ||= []
map['FullContent'] << {'ExtractedText' => event.get('ExtractedText')}
event.cancel()
"
push_previous_map_as_event => true
timeout => 3
map_action => "update"
}
But i can't see the "FullContent" Column in Kibana.
Who knows the solution?