Hi, in our project we store all our logs in one log file with the log pattern:
I set up a filebeat-logstash-es stream and i want to apply different grok patterns to different log levels.
The problem is, since i can't(shouldn't) define multiple prospectors over one file, I need another way to get the log levels before send to logstash.
First i want to use processors to find out if a log contains the level keyword. But i can't find a support processor that allows me to add additional fields, which is very easy to do in the prospectors config using:
(the [include fields] processor can't add fields and [rename] processor can't change field's value )
So my questions are:
- Can I define more than one prospector over one file?
- If not, how can i get the log level field before send it to logstash? Is there a support processors that allows me to add fields when the message contains level keyword?