You could use
grok { match => { "message" => "TEST-ERROR%{GREEDYDATA:someField}github.com/go-logr" } }
or
dissect { mapping => { "message" => "%{}TEST-ERROR%{someField}github.com/go-logr%{}"
The latter is probably cheaper.
You could use
grok { match => { "message" => "TEST-ERROR%{GREEDYDATA:someField}github.com/go-logr" } }
or
dissect { mapping => { "message" => "%{}TEST-ERROR%{someField}github.com/go-logr%{}"
The latter is probably cheaper.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.