Logstash enrichment

Elastic Stack Logstash
1

Hi everyone,

I have date on the first line of my log . The subsequent lines only contain time. I would need to prefix date to each of the subsequent lines .

Please suggest an enrichment plugin that fits my requirement. I am pararelly browsing to see if I can find something that fits me.

Regards,
Pavan

2

It sounds like the Aggregate plugin may do what you need.

3

If aggregate does not work you could resort to ruby.

4

Thanks in advance. I will try this out and let you know

5

Looks like aggregate is only for aggregating information spread across multiple events. I just want to prefix a string before every event . I will see what is available

6

sorry, I didn't notice your reply until now. I thought you needed to take the date from the first line, then add that to all the subsequent lines. is that not the case?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.