I have a field that looks like that
lists: list1 list2
The number of lists is not defined, here it's 2 but it can be 3 or 4
I'd like to create new fields with new values
lists1 => list1
lists2 => list2
Do you know how can I do that ?
The syslog message looks like this
IP.43.144.37: disconnected after 11 seconds. lists: blockliste spamliste
And I have a grok rule that retrieves "blockliste spamliste"
I would like to make statistics regarding spam lists: the spam list that bloc the most spam mails.