Hi
I am reading the documentation on the Aggregate Filter, but all examples assume there is something common between the lines (events) to be aggregated. Usually, that common entity is also used as task_id.
But my case is like this:
...
something happened on hostname a.b.c because this and that
...
the action was done by user joe because blah blah
...
From those log lines, I need LogStash to create a single document like
{
"hostname" => "a.b.c"
"user" => "joe"
}
Is there an easy way to do it?
Any tip is more than welcome.
Cheers,
Jose