ElasticSearch filter - add tag

Elastic Stack Logstash
1

Hey, is it possible to do something like this:

         elasticsearch {
            hosts => ["es-server"]
            query => "type:start AND operation:%{[opid]}"
            fields => { "@timestamp" => "started" }
         }

But then add a tag to the previous event so it cannot be a result of the query again?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.