OK, I would use ruby for that. Something like this. You would not need to grok, just the ruby filter and
m = event.get("message").scan(/(\w+):(\w+)/)
1 Like
OK, I would use ruby for that. Something like this. You would not need to grok, just the ruby filter and
m = event.get("message").scan(/(\w+):(\w+)/)© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.