Hi Experts, I need to overwrite my message field once I am done with kv filter . My flow would be like input{} filter { grok { match=>["message",'CEF:%{CEFNUM:cef}[^\|\n]*\|%{CEFBAR:dvcvendor}\|%{CEFBAR:dvcproduct}\|%{CEFBAR:dvcversion}\|%{CEFBAR:alert}\|%{CEFDEV:alertmsg}[^\|\n]*\|%{CEFDEV:se…

magnusbaeck (Magnus Bäck) April 19, 2016, 8:31am 4

Perhaps you can just use the mutate filter's gsub option?

Topic		Replies	Views
Remove a specific field from the log and overwrite the message field Logstash	8	2262	April 2, 2020
Duplicate entries after grok Logstash	3	3219	July 6, 2017
Overwrite message field issue in grok match Logstash	4	3177	January 19, 2021
KV Filter Question Logstash	21	7335	May 25, 2017
Message field within message Logstash	21	10006	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to overwrite/rewrite message field after kv and remove field filters?

Related topics