Join data for events

Elastic Stack Logstash
1

Dear All,

I want to get query view for filename against the username . filename comes from event2 and username comes from event1 for both events pid common.

Event 1 fields => timestamp pid username
Event 2 fields => timestamp pid filename read/write

desired query view => event2_timestamp event2_pid event1_username(match pid) event2_read/write

2

You may be able to do that using an aggregate filter to combine the two lines.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.