daaakeee
(Daulet)
July 17, 2017, 12:49pm
1
Hello! I am trying to split the message field into array and create many columns according to the list I got.. Can I do this?
logstash filter config is like below:
grok {
match => {
"message" => "%{GREEDYDATA:data}"
}
}
mutate {
split => ["data", ":::"]
}
translate {
dictionary => data
}
message looks like below
term:::asd:::session_id:::qwer123asd
So that I get 2 fields term and session_id
jsvd
(João Duarte)
July 21, 2017, 4:24pm
2
the translate filter isn't useful here, maybe something like:
input { generator { count => 1 message => "term:::asd:::session_id:::qwer123asd" } }
filter {
mutate { add_field => { "data" => "%{message}" } }
mutate {
split => ["data", ":::"]
}
ruby { code => 'event.set("data", Hash[*event.get("data")])' }
}
output { stdout { codec => rubydebug } }
system
(system)
Closed
August 18, 2017, 4:24pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.