How to use Logstash and ElasticSearch to Index 'transactionID' from 'message' while keeping original 'message' intact

Elastic Stack Logstash
1

I already have ELK setup for my Java application and I'm able to see the logs in Kibana.

I have a field called 'message' in which I have a string called transactionID and a value assoicated with it (eg: transactionID:73782983848748937947). Now I would like to see transactionID as a seperate field in kibana. At the same time I want to see the original message also.

Please see below screenshot.

ELK Snapshot
ELK Snapshot1850×882 99.7 KB

In this I want transactionID also to be listed just like 'fields.app','fields.container', 'fields.environment' etc. And I want the 'message' to be retained as it is.

Please provide your suggestions about the right approach to achieve this using logstash and ElasticSearch

All my ElasticStack components are 7.6.2 version

2

A grok filter with the pattern \[transactionId=%{NUMBER:transactionId}\] could create that field for you.

3

Thanks for the reply @Jenni. let me try that and get back to you.

4

@Jenni The suggestion worked for me. Thanks for your input

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.