How to parse first line in all the next lines

Hello everyone,

I am having the following log :

Sun Dec 20 00:40:05 CST 2020: Starting docker, stream=prod, version=latest, pwd=PATH
Processing...
SERVER oc: Successfully processed 23 TSM servers. Failed: 23
Details:
1 (Host1): HTTP POST request failed, rc=500, null, msg=Internal Server Error
2 (Host2): TSM Server registration not found for hostname Host2
3 (Host3): HTTP POST request failed, rc=500, null, msg=Internal Server Error
4 (Host4): Index: 0, Size: 0
5 (Host5): TSM Server registration not found for hostname Host5
6 (Host6): HTTP POST request failed, rc=500, null, msg=Internal Server Error
7 (Host7): TSM Server registration not found for hostname Host7

Processing completed, elapsed time=896.59 seconds
Sun Dec 20 00:55:05 CST 2020: Finished, rc=0

I need that somehow filebeats read just the events that start with a number but adds the first line of date to each one of them, for example:

Sun Dec 20 00:40:05 CST 2020: Starting docker, stream=prod, version=latest, pwd=PATH 1 (Host1): HTTP POST request failed, rc=500, null, msg=Internal Server Error

Sun Dec 20 00:40:05 CST 2020: Starting docker, stream=prod, version=latest, pwd=PATH 2 (Host2): TSM Server registration not found for hostname Host2

This since I need to extract every host event but with a date associated to it.

Can you Help me please?

Thank you

Regards

Kevin Scott Urbina Moreira

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.