How can I see the full name of protocol in the index?(hyphen problem)

Elastic Stack Logstash
1

Hello.
I now have an index on elasticsearch after converting the pcap file to json.

One of the protocols has a full name of "s7comm-plus", but only "plus" is visible in the index.

The other protocols look correctly.

My logstash fileter is below.

Extract innermost network protocol

 grok {
     match => {
         "[layers] [frame] [frame_frame_protocols]" => "% {WORD: protocol} $"
     }
 }

How can I change the logstash filter or elasticsearch?

2

Update: I just realized this is a logstash question and I answered with an Elasticsearch example. The core of it however is still true and you need to change your pattern type. I also moved this to the logstash forum.

Take this example

POST /_ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "_description",
    "processors": [
      {
        "grok": {
          "field": "input",
          "patterns": [
            "%{WORD:output}"
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "input": "s7comm-plus"
      }
    }
  ]
}

when running this, you will see that the output only contains s7comm, as the dash is a word boundary. You could try sth like USER instead of WORD and see if that works, as that one includes a dash. You could also come up with your own pattern using a better name :slight_smile:

3

Thank you for replying.
I solved this problem by using 'if' statements in the logstash config file.

Thank you and have a great day :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.