How to extract the data?

Elastic Stack Logstash
#1

Below is the data in json :-1:

{
"_source": {
"notification": {
""eventDescription": "[Monitored alert priority >=4] [***] [https://***] [The application powershell.exe is executing a fileless script or command.] [Incident id: ***] [Threat score: 4] [Group: ******] [Email: ****] [Name: ******] [Type and OS: WINDOWS Windows 10 x64] [Severity: Monitored]\n","
}
}
}

I want parse the data of eventDescription field. Help is needed.

#2

From where you wanted to parse the data ? Can you mention it little bit clearly ..Are you trying to parse the data from elasticsearch to somewhere else ??

#3

Hi,

From logstash.

#4

You can use the kv filter's include_keys option to parse only the particular field from logstash to elastic search .
refer :https://www.elastic.co/guide/en/logstash/6.5/plugins-filters-kv.html
Hope it helps.

#5

@Gmoathi.. Didnt work..

#6

The message is delimited using [ and ], so I would use a dissect filter for that.

1 Like
#7

@Badger, i will check and get back to you

#8

dissect filter helps me to extract it..

#9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.