Hi, I am fetching the data from Azure - event hubs , I need to split the data which is in message field and i have tried split filter and grok filter it is showing the error which is in tags. Please help me to sort out which filter can be used and how it can be done.
I would suggest using mutate+gsub to strip off the first few characters then using a json filter to parse the data.
Hi, This is logstash config file i have used mutate + gsub and parse through json
whether this the correct way to do this
I am facing this error can you please help me to sort out this..
Please do not post pictures of text, they are hard to read and some folk will be unable to read them.
Remove the trailing comma from"message", "/", ",",.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.