11191
(Алексей Лалетин)
September 18, 2020, 2:19pm
1
I have a log looking like:
[2020-09-18 12:34 smth1=38 smth2=125 ... ]
and I want "smth1" to be a field name and "38" its value, what would be best way to do it considering that "smth1" might be different each time?
%{TIMESTAMP_ISO8601:time}%{SPACE}smth1=%{NUMBER:smth1:float}
would be hardcoded way I want to avoid.
Badger
September 18, 2020, 3:14pm
2
Use a dissect filter to take off the date, then use a kv filter.
dissect { mapping => { "message" => [%{timestamp} %{+timestamp} %{restOfLine}" } }
kv { source => "restOfLine" }
system
(system)
Closed
October 16, 2020, 3:14pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.