Hi
I'm trying to populate a certain field (lets call it ioc) with one of 2 values: in 1 log it will be an IP Address and in another it will be a Domain. Is there a way to tell logstash to take the field that exists?
when log1 will be processed there will be an IP Address in the ioc field, and when log2 will be processed a domain name will be in the ioc field?
Sure, that's possible but we can't give specific advice without details on your setup and your events.
It might however not be wise to do so since ES has a data type for IP addresses (supporting IP address range queries) that you might want to use for your IP addresses, but that data type can't store hostnames. That would be a reason for using multiple fields.
Hi Magnus,
i know that i'll need data type IP Address, and i want to add that data ALSO to another field -
which is the one i'm talking about. For examle i have an IP Address OR a Domain, when there is an IP it will be inserted to IP Field and in the log there will be no domain so that's not a problem. when there is a domain it will be inserted into a domain field and in the log there will be no IP.
I want to insert every time one of them into a 3rd field, so every time i'll have the one that was in the log.
Shai