We are getting multiple events come in ( because of multiple botnet calls, but it is the same SRC and DST) How do you use the aggregation plugin to combine it all into 1 . Timestamps are slightly different Time src dhost dst requestMethod request act …

Logstash Aggregation Plugin

Elk_huh (Brian) June 6, 2019, 6:58pm 5

Thats the problem, We get multiple events from zscaler for the same thing that happened . Thats why im trying to condense it into 1 document

Topic		Replies	Views
Logstash in Docker - Combine 2 events into 1 event Logstash	1	651	November 14, 2017
Combining two events in one Logstash	9	9687	July 6, 2017
Combine Log Lines That Share A Unique ID Logstash	4	10107	July 6, 2017
How can i aggregate this Logstash	1	456	June 22, 2017
Aggregating json events Logstash	2	363	November 19, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash Aggregation Plugin

Related topics