How to extract the data?

Elastic Stack Logstash
1

Below is the data in json :-1:

{
"_source": {
"notification": {
""eventDescription": "[Monitored alert priority >=4] [***] [https://***] [The application powershell.exe is executing a fileless script or command.] [Incident id: ***] [Threat score: 4] [Group: ******] [Email: ****] [Name: ******] [Type and OS: WINDOWS Windows 10 x64] [Severity: Monitored]\n","
}
}
}

I want parse the data of eventDescription field. Help is needed.

2

From where you wanted to parse the data ? Can you mention it little bit clearly ..Are you trying to parse the data from elasticsearch to somewhere else ??

3

Hi,

From logstash.

4

You can use the kv filter's include_keys option to parse only the particular field from logstash to elastic search .
refer :https://www.elastic.co/guide/en/logstash/6.5/plugins-filters-kv.html
Hope it helps.

5

@Gmoathi.. Didnt work..

6

The message is delimited using [ and ], so I would use a dissect filter for that.

7

@Badger, i will check and get back to you

8

dissect filter helps me to extract it..