Mutate to concatenate two filed

Elastic Stack Logstash
1

Hi Team,

I am using multiple grok filter to capture specific patterns from the log file.Now i want to concatenate one of the filed of first grok filter with one filed of second grok filter.

      mutate { 
add_field => ["field3", "%{field1} %{field2}"]

}

My doubt is that :

  1. While doing this do i have to put the check of Path as well, so that mutate should add filed of same file(Path).
  2. Logstash excute all filters/configuration file wise file or it parse multiple files at a time?

Thanks

2

The filters are executed sequentially in the order laid out in the config. There is parallel execution with multiple workers, but once a worker thread takes a batch of events from the queue no other threads (workers) act on those events.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.