Copy data from a field and make it available for all the documents

Elastic Stack Logstash
1

I am using grok filter to pass the number from a document of field message.

For instance,

The build ID of the run is : 128

From the above document entry I have used grok to extract "128" to a new field.

However , the problem is that when I use "discover" to search for "128" only one entry of it is available.

image

Is there a way to pass the field value (that holds 128) to all the documents such that each entry holds the number .

I have tried using logstash-jenkins plugin , but I am not able to use grok in the plugin.

Please help.

2

Can you provide some more detail? What does your current logstash configuration look like and what do the logs look like.

3

@Badger Thank you for responding.

I am using the below logstash configuration :

input {
beats {
port => 5044
ssl => true
ssl_certificate => "/security/logstash.crt"
ssl_key => "/security/logstash.key"
}
}
filter {
grok {
match => { "message" => "^The build ID of the run is : %{NUMBER:filteredValues}" }
}
}

I am able to successfully get the number (i.e 128) in the new field "filteredValues" . The filter is from the message field and the entry of the document (The build ID of the run is : 128) is only once. As the entry of the document is only once , I am able to see the number , 128, only once in the discover feature of Kibana. What I am looking for is a way to make the number -128 available for all the entry documents. i.e make the number 128 visible for any entry . Right now all the other entries remain blank as can be seen in the below log picture.
image

How do you think can this be made possible ?

The number is basically a unique ID which I am generating using Jenkins for a particular sequence of jobs. The unique number gets incremented when a new flow of jenkins jobs is triggered. I am not looking to use any Build ID, but only the unique number that I am generating through a shell script.

4

I cannot see any way to do that based on the information you have given us.

5

Okay @Badger . Thank you.

I am trying to use fingerprint plugin here.

Also will it be possible to pass the number in the filebeat index name ??

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.