Any idea?

Elastic Stack Logstash
1

Hello guys,
I had specific log like that:
Fri Mar 18 14:06:17 2016 DISCONNECT C2075/2319 host 192.168.44.1/32949 (192.168.44.1)
Fri Mar 18 14:06:17 2016 DISCONNECT C610/3117 host 192.168.44.1/24080 (192.168.44.1)
Fri Mar 18 14:06:17 2016 CONNECT FROM C3118/- host 192.168.44.1/51345
Fri Mar 18 14:06:17 2016 CONNECT TO S3118/611 host 194.39.131.34/sapdp99 (194.39.131.34)

I would delete the word "host", Did you think it's possible in the filter ?

2 
filter {
  if [message] =~ "host" {
    drop { }
  }
}

Or if you are on linux just run the command "sed '/host/d' filename"

3

Yes , but drop delete host and everything after, I would delete only "host"

4

Use the mutate filter and its gsub option to replace "host" with an empty string.

5

Okay, I will try it :slight_smile:

6

I test with that, and it doesn't work , did I do a mistake ?

filter {
if "disconnect" in [tags] {
mutate {
gsub => [
"test", " host ", "."
]
}

PS: My tag works

7

Please show us an example event where it didn't work. Use a stdout { codec => rubydebug } output or copy/paste from the JSON tab in Kibana.

8

I test with logstash -f , I can only show you a screenshot :confused:

image.png1220×306 9.35 KB

I want to delete the word "host" because i want take the session (C2362/2980) and the IP with the port.
I can take the IP/port and the session , but not together because there is the word host who block the match

9 
filter {
   if "disconnect" in [tags] {
      mutate {
         gsub => [
            "message", " host ", "."
         ]
       }
   }

I think you use gsub on the wrong field

10

Nice , thank you it works :slight_smile:

11

I test with logstash -f , I can only show you a screenshot

I'm quite sure that your terminal window allows you to select text and copy it so that you can paste it into a tab in your web browser.

12

Ah , yes but i think you want only a json file :confused: