Hello,
What is placing specific data, such as an IP address, into a field, perhaps called src.ip called? I'm asking so that I can begin to learn by searching.
Thank you!
I don't know if there's a specific term we use to call it, but the general approach is data processing.
I think the word you are looking for is indexing? E.g. I indexed the data into my indices.
I think the word you are looking for is parsing.
For example, from the Merriam-Webster dictionary you have this definition for a parser.
a computer program that breaks down text into recognized strings of characters for further analysis
Another example, from the description of logstash json filter.
This is a JSON parsing filter. It takes an existing field which contains JSON and expands it into an actual data structure within the Logstash event.
And the same thing for the logstash grok filter
Parse arbitrary text and structure it.
Grok is a great way to parse unstructured log data into something structured and queryable.
1 Like
Yeah, that's pretty spot on!
Okay! This is helpful. So many responses! Have a great day. I hope I don't have to select just one as The Solution but if I do, and it's not you, it's not personal!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.