Hi all,
I have a message log below:
<85>1 2021-05-11T09:25:02+07:00 172.19.16.241 CP-GW - Log [Fields@1.3.6.1.4.1.2620 Log delay="1620699902" src="172.19.9.18" dst="172.19.11.13" proto="6" UP_match_table="TABLE_START" ROW_START="0" match_id="35" layer_uuid="f5cec687-05e5-4573-b1dc-08119f24cbc9"
="Network" rule_uid="21e1b03b-5e20-4913-9d84-468164e67d8a" rule_name="" ROW_END="0" UP_match_table="TABLE_END" ProductName="VPN-1 & FireWall-1" svc="10051" sport_svc="64308" ProductFamily="Network" ].
I would like to define field for this message with output like this:
{
timestamp => 2021-05-11T09:25:02+07:00
src_ip => 172.19.9.18
dst_ip => 172.19.11.13
UP_match_table => TABLE_START
ROW_START => 0
match_id => 35
layer_uuid => f5cec687-05e5-4573-b1dc-08119f24cbc9
layer_name => Network
rule_uid => 21e1b03b-5e20-4913-9d84-468164e67d8a
rule_name => " "
ROW_END => 0
UP_match_table => TABLE_END
ProductName => VPN-1 & FireWall-1
svc => 10051
sport_svc => 64308
ProductFamily => Network
}
I read about logstash filter but I'm confused which filter I should use. Can you help me figure out
Please don't post pictures of text, they are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them
It came out with "layer_name" => "layer_name="Network"", and I would like to ignore the specific text before "Network", so the result should be "layer_name" => "Network"
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.