I want to create grok match and have the 2 first words and the last part of the message.
For example:
ERROR;AuthenticationController ;processMessage ;THR=11107194 R=760a52d97983874 T=6031a0711ec3 U=Unauthenticated I=78.21.19.214 A=- C=0001 O=- V=-;Code[TXT-CD,LAA001] transformation to input contract failed
I have this filter
(?((?:.(?!;))+$))
Result:
"exceptionHeader": [
[
";Code[TXT-CD,LAA001] transformation to input contract failed"
]
Any idea how I can add "ERROR;AuthenticationController" to "exceptionHeader"?
thx
I don't know if it's possible to put all the values you want directly in a unique field. So i put values in multiple field and put them together in a new field with add_field option.
After that, i remove duplicate data with remove_field.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.