Hi guys please verify whether this is the proper way to use grok ?
If "i am happy: true" in [message] {
grok { match => "message" , "%{GREEDYDATA:myfield"}
}
My intension is to create a new field based on spesific string to be selected in message for visualization later.
Any help is really really appreciated as im still new with this elk! Thanks guys
grok { match => { "message" => "%{GREEDYDATA:myfield}" } }
That said, if you match a field against GREEDYDATA all you are doing is creating a copy of the field, which would be better done using a mutate filter.
For my case i really need to check the message content like if i am so happy: true then create one field for that like myfield or if i am so happy: false then create another field for that..is it possible to check and verify the content inside the [message] to do that ?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.