How to push droped events into elastic search

I have to index dropped events from filter plugin into elastic search . below is a sample code.


grok {
       match =>{ "message" => "(?<tran_type_isg>(?<=^.{58}).{3})(?<trash>.{11})(?<tran_type_ab>.{3})"}
#checking transaction type and parsing
 if [tran_type_ab] == "ABC"{
     #do something
	 match => { "message" => "(?<CRD_NO>(?<=^.{58}).{3})"  }
 else if [tran_type_ab] == "DEF"{
 #do something
 #how to index dropped events into elastic search?

I also would like to know the location where dropped events are placed if any?

for reading and helping

They are not placed anywhere. They are dropped -- i.e. deleted. If you want to index them then do not drop them.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.