WorkFlow:
Beats (7.0) > Logstash > Elastic
Issue:
The process ID shown below in Elastic is not parsed correctly, we would like it to be without commas.
event.ParentProcessId : 1,739,524,678,541
Three different configs I have tested, in our logstash,
filter {
kv {
source => "metadata"
trim => """
include_keys => [ "ProcessId","ParentProcessId"]
target => "kv"
}
filter {
grok {
match => { "message" => %{DATA:ProcessId},%{DATA:ParentProcessId} }
}
}
filter {
if [event][ParentProcessId]
grok {
match => { "message" => %{DATA:ParentProcessId} }
}
if [event][ProcessId]
grok {
match => { "message" => %{DATA:ProcessId} }
}
}
Any ideas, what am I missing here?