Logtash copy one field to another in a different log

Elastic Stack Logstash
1

Hello,
I have the following sample log.

Feb  1 15:30:49  sudo: pam_unix(sudo-i:auth): authentication failure; logname= uid=10050 euid=0 tty=/dev/pts/2   user=test



Feb  1 15:30:50  sudo: pam_sss(sudo-i:auth): authentication success; logname= uid=10050 euid=0 tty=/dev/pts/2

I am using elapsed logstash filter to calculate the time difference. I have it working, however I need the second log to have the field user=test as in first log so that I can use the field in Kibana Visualization.
Any ideas on how this can be achieved?
Thank you.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.