Hi team , im trying to dissect the message log
I'm trying to parse the "Message" column, I tested it in Elastic cloud and the command in the ingest pipelines tab was working
My config in logstash conf.d
input {
syslog {
host => "xxx"
port => xxx
codec => cef
syslog_field => "syslog"
grok_pattern => "<%{POSINT:priority}>%{SYSLOGTIMESTAMP:timestamp} CUSTOM GROK HERE"
}
}
filter {
dissect {
mapping => {
"message" => "<%{case.number}>%{@timestamp} %{ip.reporting} : %{tool.name};%{tool.id};NEC - Sev %{severity.modifier} %{severity.rating};Line %{tool.line};Alarm: NEC - Sev %{alarm.modifier} %{alarm.rating}|Trigger Date: %{trigger.d$
}
}
}
output {
elasticsearch { cloud_id => xxx
cloud_auth => "xxxx"
index => "nec_latam_noc_brasil_pa_banpara-%{+YYYYMMdd}" }
file {
path => "/var/log/resultado.log"
file_mode => 0777
codec => plain
}
}