Hello
I am passing values as an array to elasticsearch and when I saw the result I got a question.
Is it possible to make line spacing in an array so that it can be easier to read?
At the moment, the kibana dashboard looks like this.
I wish it looked like this
My logstash config file:
filter {
if "mdaemon_smtp_combine-in" in [tags] {
grok {
patterns_dir => ["/etc/logstash/patterns"]
break_on_match => false
match => {
"message" => [
"%{TIMESTAMP_ISO8601:timestamp_custom}",
"[%{SESSION_ID:session_id}]",
"(?i)<-- MAIL FROM:\s*<%{MAIL:mail_from}>",
"(?i)<-- RCPT TO:\s*<%{MAIL:mail_to}>",
"message saved <Message-ID: <%{NEXT_LINE:message_id}>>"]}
}
if "mdaemon_smtp_combine-in" in [tags] {
ruby {
code => "event.set('test_array', event.get('message').scan(/(?i)<-- RCPT TO:\s*<([a-zA-Z0-9_.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:.(?:[0-9A-Za>
}
}
}
}