Imho that are 2 different questions but anyway, I solved this question by splitting the "IPORHOST" pattern into e.g. (?:%{IP:src_ip}|%{HOSTNAME:src_hostname})
1 Like
Imho that are 2 different questions but anyway, I solved this question by splitting the "IPORHOST" pattern into e.g. (?:%{IP:src_ip}|%{HOSTNAME:src_hostname})
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.