How do I map fields with ECS if I am using my own grok filters

Elastic Stack Logstash
1

Hi Team,

Here is my grok parser

match => { "message" => "(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) rpz: info: client @%{WORD:data} %{IPV4:clientipaddr}#%{INT:sport} \(%{NOTSPA
CE:qdomain}\): rpz QNAME Local-Data rewrite %{NOTSPACE:origdom} via %{NOTSPACE:rewritten}"

This is a BIND RPZ and wondering how do I convert those so that they adhere with ECS? Can someone please help?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.