I have a log patern that look like this
(windows event log) Dummy request has been approved.|Node=blah-blah.example.net_iam|BatchSig=jhsdjahsdgsjahdg|Requester=john.test|Recipient=ex0000123456
below grok pattern seems to do the trick correctly
Dummy request has been approved.|Node=blah-blah.example.net_iam|BatchSig=jhsdjahsdgsjahdg|Requester=john.test|Recipient=ex0000123456
From this above log message
I need to put them in fields as below.
message:Dummy request has been approved.
winlog.event_data.Node=blah-blah.example.net_iam
winlog.event_data.BatchSig=jhsdjahsdgsjahdg
winlog.event_data.Requester=john.test
winlog.event_data.Recipient=ex000012345
In the actual documents, I have field values like this
winlog.channel:Example-Example ID Systems-Example ID Suite/Operational
winlog.channel:Example-Example ID Systems-Example ID Suite/Admin
And I need to apply above processor only for these events.
How can I do this?
Right now, what I have is this. Which is clearly not working "if": "ctx?.winlog?.channel ==~ /Example*/",
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.