Copy the value of a field into an event and paste it into another field and another event

Elastic Stack Logstash
1

Hi Everyone,

My doubt is for example:

{
"offset" => 7,
"word1" => "XPTO", <- Copy this value
"@metadata" => {
"beat" => "filebeat",
"type" => "log"
},
"input_type" => "log",
"source" => "mylog.txt",
"message" => "XPTO,",
"type" => "log",
"mac" => "1512150Z000",
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_grokparsefailure"
],
"second" => "50",
"datetime" => "04/20/2017 06:13",
"@timestamp" => 2017-05-30T21:13:37.982Z,
"@version" => "1",
"beat" => {
"hostname" => "my-PC",
"name" => "my-PC",
"version" => "5.4.0"
},
"host" => "my",
"t1" => "SFCS",
"t2" => "MAC"
}
{
"offset" => 17,
"@metadata" => {
"beat" => "filebeat",
"type" => "log"
},
"input_type" => "log",
"word3" => "A0000",
"word2" => "NG",
"word1" => "XPTO", <- Paste Value . (This field does not exist at this event)
"source" => "mylog.txt",
"message" => "NG,A0000",
"type" => "log",
"mac" => "1512150Z000",
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_grokparsefailure"
],
"second" => "50",
"datetime" => "04/20/2017 06:13",
"@timestamp" => 2017-05-30T21:13:37.982Z,
"@version" => "1",
"beat" => {
"hostname" => "my-PC",
"name" => "my-PC",
"version" => "5.4.0"
},
"host" => "my-PC",
"t1" => "SFCS",
"t2" => "MAC"
}

I'm using ELK 5.4
Filebeat and Logstash;

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.