Hi,
I have request and response files which I need to process and correlate both the file fields and to correlate it. In my scenario filebeat picking up the files in random hence sometime my response files getting read instead of request files. So to cover all the scenarios I have the logic both in my response and request logstash configuration files. Below are my sample code.
Request section:
filter{
.......
elasticsearch {
hosts => ["xxxxx.xx:9200"]
query => "fileidres:%{fileidreq}"
fields => [
"status","status",
"creationTime","creationTime",
"fileidres","fileidres"
]
}
if [status] == "CODE"
{ <Some logic>
}
}
fileidres
is the field created in response
block and fileidreq
was created in request
block
Response Section:
filter{ grok { match => { "responseDesc" => "(?<status>CODE)" } } }
-
I would like to know is thee any option to make
Filebeat
orLogstash
to process therequest files
first beforeresponse file
s. -
Is there any attribute available in
Elasticsearc
h filter to collect all data if the query is success.
Thanks in advance