Hello,
I was wondering if there exists a more elegant way to do this.
Currently, in my pipeline to process .log files, I used grok filter to filter field header and field data.
This allows me to achieve 40 fields & 40 fields data.
To properly display it on kibana, i did this:
if [header40] =~ /.+/ {
mutate {
add_field => { "%{header1}" => "%{header1_data}" }
remove_field => [ "header1", "header1_data" ]
....... (repeats for 40 times)
.......
add_field => { "%{header40}" => "%{header40_data}" }
remove_field => [ "header40", "header40_data" ]
}
}
Is there a way to iterate this using a for loop so that it can be short & concise?