How to Edit logs with gork?

Elastic Stack Logstash
1

I have a log winlog.evend_data.RuleName : technique_Id=T2343,techniqueName=asdfdasd

I want to change it to winlog.evend_data.RuleName : technique_Id : T4343 , techniquw_name : asdfdasd

I just need the regular expression for this.
NOTE: Please don't share useless links be specific .. I don't need generic solutions. And Don't post Gork tutorials videos etc

2

Try using gsub filter,

mutate {
    gsub => [
      # replace equals with a colon ":"
      "winlog.evend_data.RuleName", "[=]", ":"
    ]
  }

Assumes winlog.evend_data.RuleName is a field name.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.