Join two logs by common field

Elastic Stack Logstash
1

Hello,

I am trying to get a useful information from two logs format. Let me Start the call flow.

Msgs:-

dhcp,info dhcp 414 assigned 10.101.193.4 to F0:::::40
hotspot,account,info,debug cb8xgh (10.101.193.4): logged in
hotspot,info,debug cb8xgh (10.101.193.4): logged out: session timeout
dhcp,info dhcp 414 deassigned 10.101.193.4 from F0:::::40

I can parse each one individually, And as you can see IP address is the common term. So, I want to bind those logs as I can read " The specific IP address for the specific username assigned to this mac "..

My ultimate goal is to be able to get the session details like that: username used a mac address, logged in at a time,logged out at a time.

2

Does the collate filter help?

3

No. They didn't come by sequence, There are many lines from other IPs and MACs. So I could depend on neither time nor number of lines.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.