How to split single field values in to multipleterms in logstash

Elastic Stack Logstash
1

(Fieldvalue => createdby,createdtime,updatedby,updatedtime)

i need a individual field for createdtime in my kibana option

thanks
saravanan.R

2

Hi @saravana_hariharan.

where you are using this use case?

please explain more.

Thanks
HadoopHelp

3

im using it in logfile fields time,sessionid,requestid, fieldvalue columns and my question is inside of fieldvalue column these terms are placed. how to split the createdtime value to individual field (createdby,createdtime ,updatedby,updatedtime,name,etc.,)
grok{
match =>["message","%{NUMBER:TIME} \t %{WORD:SESSIONID} \t %{GREEDYDATA:FieldValue}"]
}

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.