Ingest Pipeline for Message Field

We are using the Custom UDP Integration within Fleet. When it collects logs, it throws all the log data into a message field. I'm not very familiar with ingest pipelines and whether or not Grok or Json would be the best way to extract certain fields.

For example, below is one sample message but I not sure how I can split it out via the pipeline.

<174>Jan 24 19:52:56 INFO  uvm[0]:  {"entitled":true,"CClientAddr":"192.168.X.X","sessionId":XXXXXX,"SClientAddr":"192.168.X.X","CClientPort":33986,"timeStamp":"2022-01-25 02:52:56.312","protocol":17,"clientIntf":0,"hostname":"192.168.X.X","CServerPort":53,"policyId":0,"SClientPort":33986,"protocolName":"UDP","bypassed":true,"SServerPort":53,"CServerAddr":"","localAddr":"192.168.X.X","class":"class","SServerAddr":"","serverIntf":0,"remoteAddr":""}

For example, how would I pull out the CClientAddr field into client.address ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.