I'm receiving some logs like these:
datetime="2020-09-2020T14:40:00-0300" action="tunnel-up" tunneltype="ssl-tunnel" tunnelid=1171992131 remip=192.168.0.1 user="someuser" group="vpn_ssl_group"
and
datetime="2020-09-2020T15:40:00-0300" action="tunnel-down" tunneltype="ssl-tunnel" tunnelid=1171992131 remip=192.168.0.1 user="someuser" group="vpn_ssl_group"
I'd like to be able to aggregate fields datetime
and action
grouped by the tunnelid
field into an array of objects.
Final document should look like this:
{
"datetime": "2020-09-2020T14:40:00-0300",
"tunnelid": 1171992131,
"user": "someuser",
"group": "vpn_ssl_group",
"remip": "192.168.0.1",
"logs": [{
"datetime": "2020-09-2020T14:40:00-0300",
"action": "tunnel-up"
},
{
"datetime": "2020-09-2020T15:40:00-0300",
"action": "tunnel-down"
}],
"duration": 3600
}
Is there any way I can do that? If so, can you please show me how?