Merge 2 fields from seperate events into one field

Elastic Stack Logstash
1

I am trying to merge the field "username" from one source (xx.xxx.xx.xx) with the field "user" from a different source (yy.yyy.yyy.yyy). I want to merge them into a new field called "User".

Example Logs:

[USERNAME= johndoe] [SOURCE=xx.xxx.xx.1]

user="janedoe" source=yy.yyy.yyy.111

I have tried adding a new field and deleting the "username" and "user" fields, but no luck. All it returns is

"User" => "%{USERNAME} janedoe"
or
"User" => "%{USERNAME} %{user}"

Conf File:
image

Any help is highly appreciated!!!

2

You appear to be applying the kv filters the wrong way around.

Please do not post pictures of text. Just post the text with appropriate markdown.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.