Combine log using logstash

(Dương Quang Thọ) #1

Hi all, I encounter with problem about zimbra mail log. When a user send email, zimbra create 2 log.
First log with some field: email_id, sender, receiver, subject....
Second log with field: email_id, status (ok if email sending successfully, otherwise it will be failed)

I wonder how can I using logstash to combine two log into one using field email_id. Which only 1 log we can follow it easily than now.

(Magnus Bäck) #2

Have you looked at the aggregate filter?

(Dương Quang Thọ) #3

I had looked at the aggregate filter but I think aggregate filter is suitable for statistic. Do you have any exp using aggregate to solve my problem, bro?

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.