Match a string and then assign this string to the output field

I have a requirement to match a string out the log, say 'ABC123' or 'XYZ456'.

Once this is identified, I want to assign this string into the output field. How can I do it? I can obviously use add_field with the hardcode value, but it will be tedious to do so and end up with many grok statement. Any better way?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.