Match multiple values into one field

[victor.nilsson]

Hi,

We want to match multiple values into one field from a single Document/Message.

For example, the following message:

"Testlog, Field1=value1,asdasda,asdasd,asdasd,Field2=value2"

With the following grok patterns:

"Field1=%{WORD:matched_field}" And "Field2=%{WORD:matched_field}".

So we want to create a field, "matched_field" and populate it with values from two matches. Our concern is that if we match on "Field1" it will overwrite the value when it matches "Field2". We simply want to append it and have both matches in a single field. We have set the logstash pipeline to not break on match.

[CristianoFerreira]

Hi,

You could do the following grok patterns:

"Field1=%{WORD:matched_field_1}" And "Field2=%{WORD:matched_field_2}".

And then concatenate like:

mutate {
   add_field => {
      "matched_field" => "%{matched_field_1} %{matched_field_2}"
   }
   remove_field => ["matched_field_1", "matched_field_2"]
}

Best Regards

[victor.nilsson]

I don't think that's really what we are trying to do.

We want to have two values in one field. Like this:
Field1: value1,value2

[Badger]

@victor.nilsson

Our concern is that if we match on "Field1" it will overwrite the value when it matches "Field2".

No it will not, you will end up with matched_field being an array containing both values.