How to extract first line of a multiline message?

Elastic Stack Logstash
1

I need to add a new field as the first line of a multline message coming from filebeat to logstash?
Then from this line, a substring of this line as new field which I need to parse it as timestamp?

Thanks for your help.

2

Don't describe what you want to do, show examples instead.

3

Gotta agree with Magnusbaeck here, need a little more. Do you have a sample document you can share that you are trying to ingest? If you are just trying to add a new field, you can do that in the filter section with any of the filters, it's a common function to all of them.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.