Can I decode the values in Logstash

Elastic Stack Logstash
1

Hi,

I have the key value pairs in the log message and I want to do data mapping before indexing the data to ElasticSearch.

Sample Log Message 1: operation=1 timetaken=50
Sample Log Message 2: operation=2 timetaken=100

I want the output in ElasticSearch to be as below.

{
 {
   "operation" : "ABC",
   "timetaken" : "50"
 },
 {
   "operation" : "XYZ",
   "timetaken" : 100
 }
}

I want to map operation values as 1 to ABC & 2 to XYZ . Is this possible with any filters ?

2

You could try using a kv filter to parse the message and then a translate fitler to map the values.

3

Thank you. That should work

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.