Hi,
I am using logstash to parse logs from txt file.I am having field "mstrGateway" and "MstrGateway" in two different logs, how to parse this field in single "mstrGateway" field.
If I make two different fields such as "mstrGateway" and "MstrGateway" then viz will not provide the correct data as both fields are same.
logs-
STAT : <....> mstrGateWay: ABC
STAT : <......> MstrGateWay ABC
current logstash conf filter-
filter{
grok {
break_on_match => false
match => {
"message" => [
"mstrGateWay[:\s]*(?<mstrGateway>[A-Z0-9]+)",
"MstrGateWay[\s](?<MstrGateWay>[A-Z0-9]+)",
"STAT[:\s]*(?<STAT>[A-Z]+)"
]
}
}
}
Thank you !!