i use the http://grokdebug.herokuapp.com/ to filter the log content like "Tue Aug 9 14:35:07 2016 8.8.8.8:30044 [name] Peer Connection Initiated with [AF_INET] 8.8.8.8:30044"
when i use two rules ,it show results
but when use three rules,it doesn"t work
The IP address is followed by ":30044" but you're not taking that into account in your expression.
OK，sloved,thx
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
