I am very new to elastic and would like to get an advice.
I have messages looking something like that:
THREAD_ID:101 MSG_TYPE:1 FINAL_STATE:EXPIRED
THREAD_ID:101 MSG_TYPE:2 FINAL_STATE:DELIVERED
They arrive in an uncontrolled manner:
-sometimes MSG_TYPE:1 comes first,
-sometimes MSG_TYPE:2 comes first,
-sometimes only one of them arrive,
-they never arrive from the same file.
I need to write such logstash config that only MSG_TYPE:1 info would be updated and I need to add additional field indicating which came first. For example if MSG_TYPE:2 came second it should look like that:
THREAD_ID:101 MSG_TYPE:2 FINAL_STATE:DELIVERED RECEIVED:1,2
And if it arrived first:
THREAD_ID:101 MSG_TYPE:2 FINAL_STATE:DELIVERED RECEIVED:2,1
The solution I'm looking for should work in real time. Could you please advise me on what filters or methods to use in this case?