Hello,
I am using logstash 7.6.2
I am trying to parse a CEF log, separated by pipes "|"
I've done:
mutate {
copy => { "cefmessage" => "tmp_message" }
split => { "tmp_message" => "|" }
add_field => { "cef_device_vendor" => "%{[tmp_message][1]}" }
add_field => { "cef_device_product" => "%{[tmp_message][3]}" }
add_field => { "cef_device_version" => "%{[tmp_message][4]}" }
}
I'v tried either split => {"tmp_message" => "|"} and also the split => ["tmp_message" , "|" ]
syntax, both give no error in the system logs but I dunno if it's working.
I've read on other similar topics I had to use "%{[tmp_message][1]}" instead of "%tmp_message[1]}" .
The problem is that I simple get fields with literally the string : %{[tmp_message][1]}
and NOT the content of [tmp_message][1]
I've tried without double quotes and got an error. With single quotes is the same.
I am going crazy! I am sure the solution is very simple...