I am an infant as far as Logstash+Elasticsearch is concerned. Could someone
help me out on the following:
I need to create INDEX based on the content of ACTUAL MESSAGE part of a
message forwarded to elasticsearch by Logstash.
For example:
<6> Jan 9 07:19:26 w2k8r233110 CEF:0|Trend Micro|Deep Security
Manager|8.0.1310|173|Anti-Malware Quarantined File List
Exported|3|src=10.100.33.110 suser=System target=10.100.33.111
msg=Installation/Upgrade of Anti-Malware Component on Agent
Succeeded.\n\nPrevious Version: \nCurrent Version: {1}\n
In this message, the actual message part is :
CEF:0|Trend Micro|Deep Security Manager|8.0.1310|173|Anti-Malware
Quarantined File List Exported|3|src=10.100.33.110 suser=System
target=10.100.33.111 msg=Installation/Upgrade of Anti-Malware Component on
Agent Succeeded.\n\nPrevious Version: \nCurrent Version: {1}
I need to create index based on 10.100.33.110 so that all messages with
this source comes in one document.
Thank you in advance.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/5c8193fd-5e44-4405-8b89-b4aaff5ea654%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.