Winlogbeat is sending Windows Event logs to logstash and I would like to create a new field by extracting the first line of the message field.
"message": "Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tCORP-DC02$\n\tAccount Domain:\t\tACME\n\tLogon ID:\t\t0x238BCEAE\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege\n\t\t\tSeAssignPrimaryTokenPrivilege"
I have tried many filter variations without success, here is my current but results in only a copy of the message, like it's unable to split the message by newline:
This is the result I am after: message_head: Special privileges assigned to new logon.
When testing the above filter sending a message with postman, it splits the string into an array and produces the desired results. However, I get a string copy of the message when received from Winlogbeat.
That will split it into an array of several hundred single characters. So yes, "%{message_head[0]}" will just pick up the first character of the original message.
Badger, I finally understood what you were saying and it works perfect, thanks for helping me out. I've searched through the forums and read through the documentation and nowhere did I come across anything that refers to a literal return.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.