I want to enhance my logging. Imagine the following log lines:
conn_id=1234 accept connection from 192.168.0.1 conn_id=1234 authentication successful user1 conn_id=1234 search request xyz conn_id=1234 delete request xyz conn_id=1234 disconnect
I don't think that the aggregate filter does what I want. I still want to keep all log lines, but with enriched log information from previous log lines. The following is an example output I wish to have:
conn_id=1234 accept connection from 192.168.0.1 conn_id=1234 authentication successful user1 [192.168.0.1] conn_id=1234 search request xyz from user1 [192.168.0.1] conn_id=1234 delete request xyz from user1 [192.168.0.1] conn_id=1234 disconnect user1 [192.168.0.1]
Is there a way to do this with logstash? Also note that a connection might be open for a long time (several hours).
I could imagine extracting data into a key/value store and lookup this? Is something like this possible in logstash?
Many thanks for any hints.