How to extract a single word from keyword in order to put in cloud tags

Elastic Stack Kibana
1

Do you think it's possible to extract a single word from keyword message?

for example I have this field

@message "type=USER_AUTH msg=audit(154126859238.015:964219353): pid=272523 uid=0 auid=42943967295 ses=41"
and i would to extract just this word "pid=272523 " and put in tag cloud

Thankls

2

I would recommend breaking the message field out into individual fields during insertion to elasticsearch so your documents would look like

{
  pid: 272523,
  uid: 0,
  type: USER_AUTH
}

Then you can create a tag cloud aggregation on the pid field.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.