I have log lines like the following:
src=192.168.100.1:502 rest of message
src=[::1]:304 message details
The format is
<ip address>:<port>. I could use dissect easily except for the case shown in the second line. This could be solved if I could specify the direction of matching in dissect.
I could extract the entire string after
src= till the next space into a field and then split by
: from the right instead of doing it from the left. Is such a thing possible in Logstash currently?