There may be multiple events where I need to filter few based on field_Value
I'm expecting a conditional like below
if event_id == 1234 {
** aggregate** }
Is it possible without grok???, I found difficulty in writing grok patterns, as there may be multiple formats. I thought straight forward field check will be helpful
Thanks. I'm able to handle this with KV plugin. In my case I created nested field in logstash similar to here, Best Way to create nested field
Now I need to show this nested data in Kibana. I guess Kibana doesnt support nested field in 5.6.13. So earlier I was using copy_to through java code. I need to use same copy_to approach in logstash. Putting it simple, how can I create copy_to fields in Logstash??
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.