Logstash - Comparing two fields

Elastic Stack Logstash
1

Hi All,

I was trying to compare two fields of our windows events by creating a mutate filter ,but i couldn't get any results in elasticsearch, i checked the configuration ,it seems to be Ok.Could anyone help me on this

filter {
if "4,724" in [event_id] {
if [event_data][SubjectUserName] != [event_data][TargetUserName] {
mutate {
add_field => {
"match" => false
}
}
}
}
}

filter {
if "4,724" in [event_id] {
if [event_data][SubjectUserName] == [event_data][TargetUserName] {
mutate {
add_field => {
"match" => true
}
}
}
}
}

Any help would be really helpful :slight_smile:

Thanks In Advance,
Raj

2

The

if "4,724" in [event_id] {

condition is most likely wrong. You should use

if [event_id] == 4724 {

or

if [event_id] == "4724" {

instead (depending on the data type of the event_id field).

1 Like
3

Thank you very much for your quick response :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.