I updated the code as soon as posted it... because I tried to bring focus to what really counts above..... this line:
event['senderID'] = @@SenderId
Here I am assigning a class variable I have kept into an event field 'senderID'....
my log file data looks something like this:
line 1: date time field; server name + other fields
subsequent lines: ( details )
i used the above suggestions successfully saved class variables @@ldate, @@server from the first line :
ruby {
init => "@@ldate='', @@server='' "
code => "@@ldate=event['ldate'], @@server=event['server']"
}
and added these two properties in subsequent detail lines:
ruby { code => "event['ldate'] = @@ldate, event['server'] = @@server" }
however, the values of these properties are in array format. what i am expecting are string.
"ldate" => [
[0] "2017-03-22 02:15:10",
[1] "2017-03-22 02:15:10"],
please help
Please start your own thread.