I have a log file in input to logstash, something like that :
2015-04-08 00:21:21,248 [11 ] INFO Traitement de l'archive 20150313.tar-gz
2015-04-08 00:21:21,248 [11 ] INFO Extraction de l'archive 20150313.tar-gz
2015-04-08 00:21:57,513 [11 ] INFO Fin de l'extraction de l'archive
I already have an elapsed filter to calculate the processing time between the "Traitement" line and the "Fin de l'archive" one.
But I'd also like to index with the last line the name of the tar-gz file (here "20150313"). The issue is I need to get it from previous line.
Any help will be appreciated. Thanks