Logstash enrichment

(Pavan) #1

Hi everyone,

I have date on the first line of my log . The subsequent lines only contain time. I would need to prefix date to each of the subsequent lines .

Please suggest an enrichment plugin that fits my requirement. I am pararelly browsing to see if I can find something that fits me.


(Justin McAleer) #2

It sounds like the Aggregate plugin may do what you need.


If aggregate does not work you could resort to ruby.

(Pavan) #4

Thanks in advance. I will try this out and let you know

(Pavan) #5

Looks like aggregate is only for aggregating information spread across multiple events. I just want to prefix a string before every event . I will see what is available

(Justin McAleer) #6

sorry, I didn't notice your reply until now. I thought you needed to take the date from the first line, then add that to all the subsequent lines. is that not the case?

(system) closed #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.