Hi everyone,
I hope somebody can help me with this issue I am facing with logstash.
I am receiving some syslog, and trying to put in place some filtering and merging together 2 fields.
the simple structure that I want to implement is as follow:
I have 2 fields:
destinationUserName. sourceUsername
user1
user2
what I want is to merge together those 2 fields in one, which I called userID
filter {
mutate {
add_field => {"userID" => "%{destinationUserName}%{sourceUserName}"}
}
}
}
this worked just fine, until I realised there was a problem.
the problem is, if both fields have data, it does the merging correctly, like this
input:
destinationUserName. sourceUsername
user1. user2
output:
userId
user1 user2
but if one one of the fields is empty, I get this output
destinationUserName. sourceUsername
user1
output:
userID
user1%{sourceUsername}
which is not something I want to see in my logs.
Please guys, can somebody help to understand how can I set my logstash to merge and show only the field that has data in it?
this is the output I am expecting
input
destinationUserName. sourceUsername
user1
user2
output:
userID
user1
user2
thank you so much for your help