Merge 2 fields from seperate events into one field

I am trying to merge the field "username" from one source (xx.xxx.xx.xx) with the field "user" from a different source (yy.yyy.yyy.yyy). I want to merge them into a new field called "User".

Example Logs:

[USERNAME= johndoe] [SOURCE=xx.xxx.xx.1]

user="janedoe" source=yy.yyy.yyy.111

I have tried adding a new field and deleting the "username" and "user" fields, but no luck. All it returns is

"User" => "%{USERNAME} janedoe"
or
"User" => "%{USERNAME} %{user}"

Conf File:
image

Any help is highly appreciated!!!

You appear to be applying the kv filters the wrong way around.

Please do not post pictures of text. Just post the text with appropriate markdown.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.