Arbitrary hash to CEF custom fields?

Elastic Stack Logstash
1

I'm using the cef codec for encoding data.

CEF lets you add custom attributes with a series of deviceCustom* fields. If you've got an attribute confidence and its value is high, you can say in CEF: deviceCustomString1Label=confidence deviceCustomString1=high. This requires the message itself be a hash with separate keys for deviceCustomString1 and deviceCustomString1Label.

So I need to transform my input to fit. My input as JSON includes "attributes": {"confidence": "high"} but I need to mutate this to {"deviceCustomString1Label": "confidence", "deviceCustomString1": "high"}. What's more, I need to do this not knowing what the keys of attributes are - I want to iterate over the keys, enumerating them, and creating the CEF structure that way.

This feels beyond what the built in filters support, but I figured I'd ask to see if anybody has any wisdom. Thanks!

2

You can do something like this, but you will need to use the ruby filter and write a ruby code to create your custom fields.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.