Copy data from a field and make it available for all the documents

I am using grok filter to pass the number from a document of field message.

For instance,

The build ID of the run is : 128

From the above document entry I have used grok to extract "128" to a new field.

However , the problem is that when I use "discover" to search for "128" only one entry of it is available.


Is there a way to pass the field value (that holds 128) to all the documents such that each entry holds the number .

I have tried using logstash-jenkins plugin , but I am not able to use grok in the plugin.

Please help.

Can you provide some more detail? What does your current logstash configuration look like and what do the logs look like.

@Badger Thank you for responding.

I am using the below logstash configuration :

input {
beats {
port => 5044
ssl => true
ssl_certificate => "/security/logstash.crt"
ssl_key => "/security/logstash.key"
filter {
grok {
match => { "message" => "^The build ID of the run is : %{NUMBER:filteredValues}" }

I am able to successfully get the number (i.e 128) in the new field "filteredValues" . The filter is from the message field and the entry of the document (The build ID of the run is : 128) is only once. As the entry of the document is only once , I am able to see the number , 128, only once in the discover feature of Kibana. What I am looking for is a way to make the number -128 available for all the entry documents. i.e make the number 128 visible for any entry . Right now all the other entries remain blank as can be seen in the below log picture.

How do you think can this be made possible ?

The number is basically a unique ID which I am generating using Jenkins for a particular sequence of jobs. The unique number gets incremented when a new flow of jenkins jobs is triggered. I am not looking to use any Build ID, but only the unique number that I am generating through a shell script.

I cannot see any way to do that based on the information you have given us.

Okay @Badger . Thank you.

I am trying to use fingerprint plugin here.

Also will it be possible to pass the number in the filebeat index name ??

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.