Hi all, I'm working through a Logstash configuration which is parsing Cisco ISE log entries. I'm using multiline to collate entries into records and a grok filter coupled with a 'kv' filter which is mostly having the desired effect. There are potentially a large number of fields that are being proc…

Logstash using KV filter creating a field with an array rather than individual fields and individual values

Badger November 24, 2021, 4:53am 2

It is certainly possible. This thread is about a slightly different question, but should give you an idea of how to do it.

Topic		Replies	Views
Newbie questions about KV filter Logstash	3	480	July 6, 2017
Logstash KV filter time field Logstash elastic-stack-monitoring , elastic-stack-security	6	491	August 17, 2021
Using KV filter Logstash	4	951	July 6, 2017
Elastic not creating fields Elasticsearch	9	1515	November 7, 2017
Problem with kv filter Logstash	4	2759	July 15, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash using KV filter creating a field with an array rather than individual fields and individual values

Related topics