Nested indexing possible?

Elastic Stack Logstash
1

Hi all,

I have some plaintext logfiles which i want to have in a single event. For example:

Start time: 20200417225004
property1: value1
property2: value2
property3: value3
property4: value4
Command start time: 20200417225016
property1: value1
property2: value2
Command start time: 20200417225023
property1: value1
property2: value2
property3: value3

The phrase 'Start time' should be the trigger for an event.
All lines after are attached to this event.
All lines after each 'Command start time' should be on the same level but in a sublevel of 'Start time'

Something like this:

Start time: 20200417225004
  property1: value1
  property2: value2
  property3: value3
  property4: value4
  Command start time: 20200417225016
    property1: value1
    property2: value2
  Command start time: 20200417225023
    property1: value1
    property2: value2
    property3: value3

Is that possible?

Best regards

2

You could do it with an aggregate filter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.