Logstash enrichment


(Pavan) #1

Hi everyone,

I have date on the first line of my log . The subsequent lines only contain time. I would need to prefix date to each of the subsequent lines .

Please suggest an enrichment plugin that fits my requirement. I am pararelly browsing to see if I can find something that fits me.

Regards,
Pavan


(Justin McAleer) #2

It sounds like the Aggregate plugin may do what you need.


#3

If aggregate does not work you could resort to ruby.


(Pavan) #4

Thanks in advance. I will try this out and let you know


(Pavan) #5

Looks like aggregate is only for aggregating information spread across multiple events. I just want to prefix a string before every event . I will see what is available


(Justin McAleer) #6

sorry, I didn't notice your reply until now. I thought you needed to take the date from the first line, then add that to all the subsequent lines. is that not the case?


(system) closed #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.