Hi all,
hoping to get some feedback on this as it took me 3 days to resolve which I think is potentially a knowledge gap on my side or a BUG.
In summary:
- Two logs, I want to aggregate using the aggregate filter. One field in common between both logs
if "log1" in [tags] {
grok {
match => ["message", "(?<log1_KEY>(?<=log1key:).*?(?=\s,))"]
}
aggregate {
task_id => "%{log1_KEY}"
.....
}
}
if "log2" in [tags] {
grok {
match => ["message", "(?<log2_KEY>(?<=log2key:).*?(?=\s,))"] # log2 key would be same as log1 key as they are correlated
}
aggregate {
task_id => "%{log2_KEY}"
.....
}
}
The issue here is that aggregate filter treats both log1_key and log2_key differently even though both contain the same value. They only way I got this work is by using the same name for key id such as log_key.
So in summary I see the following when using aggregate fitler:
log1_key = 123 log2_key = 123
log1_key == log2_key ---> aggregate filter fails to match. log_key == log_key --> works
I am confused as to why this behaviour exists when the underlying values are the same?