I have server where messages are being parsed from file using grok expression and I have also messages coming from packetbeat shipper. I wanted to copy one field if certain criteria met into the one which is being parsed from grok.
Is this possible?
Please confirm?
e.g.
/var/log/exmaple.com -> grok filter
Field is domainName:
Packetbeat_client_ipaddr: 192.168.5.72
If domainName ~= test.ru
Then
copy packetbeat_client_ipaddr value to grok expression fields
Is this possible?
logstash certainly supports conditionals. That would likely be
if [domainName] =~ "test.ru" {
I do not know what you mean by "copy packetbeat_client_ipaddr value to grok expression fields". There are several functions of the mutate filter that might be appropriate.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.