Trying to work out how I can merge two logs together in the filter stage, as it cannot be done in the input..
This is because I have to pull the actual log from a field within the message.
Oh, that's painful. Can't you fix the problem at the source and get it to emit reasonable log messages? If not I probably wouldn't use Logstash to untangle the log but rather use something else and have Logstash process the results.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.