I have a Filebeat instance running along with a Logstash server, to which Filebeat data is forwarded.
Before sending data to Logstash, I want to merge certain lines of the watched log file together.
For example, I have this data:
sudo: ...session opened... sudo: ...session closed... sshd: authentication failure... sshd: authentication success...
sudo lines are two distinct log messages, but they are still related, because of the number between the square brackets for example. Same for sshd. Is there a way to merge the sudo lines (or sshd lines) so that only one message would be forwarded to Logstash, instead of one for each line? Or, more generally, merge lines that have a value in common?
I've looked into the multiline option, but it doesn't seem to be exactly what I'm looking for, as it seems more adapted to unique log entries that take multiple lines. This is not exactly my case here.
Can somebody help me please?
Thanks in advance