Can you please help me with a sample filter to achieve below condition.
If TypeTests=xyz I need to check the value of nbrun_sanityCount and split it based on space (Build OK)
Currently the filter is as below.
filter {
dissect {
mapping => {
"message" => "%{Date};%{Team};%{Environment};%{TypeTests};%{runVersion};%{nbrun_sanityCount};%{NbErrors};%{total_count};%{msg}"
periodic_flush => true
}
}
}