How to extract fields from "message" field in logstash?

Elastic Stack Logstash
1

hello, I need help in extracting the fields that come in the "message" field, in case all the fields need to be extracted, can anyone help?

here's the field:

"message": "Apr 14 16:11:36 tutorial2022-1 sshd[8454]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=xx.xxx.xxx.xx  user=root"
2

Use a kv filter.

kv { allow_empty_values => true whitespace => strict }

will produce

       "uid" => "0",
     "rhost" => "xx.xxx.xxx.xx",
      "euid" => "0",
     "ruser" => "",
   "logname" => "",
       "tty" => "ssh",
      "user" => "root",
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.