Read/Match Data

Hi Elastic,

I want to match IP address from below type of data with field, i tried Translate filter but it is not supporting for .txt format,
Kindly help me to fix this.

I am downloading this from URL, using http_poller plugin. researchscan1.EECS.Berkeley.EDU

You're downloading that data with http_poller and you want to look up the IP addresses using the translate filter? Or you want to use the data downloaded with http_poller as the lookup table for the translate filter?

Either ways will work for me, Suggest me the best approach.

If my log contains this IP it should match

Transform the data into something the translate filter understands. You have a space-separated text file so it's not like YAML, JSON, or CSV is vastly different.

I tried to match the data with below mentioned script, but not getting correct output, at the same time i am able to achieve at grok debugger.

input {

stdin {codec => json_line}
filter { grok {match => { "message" => "(?<IP1>.*)\t(?<msg1>.*)\n(?<IP2>.*)\t(?<msg2>.*)\n(?<IP3>.*)\t(?<msg3>.*)" }    }



stdout { codec => rubydebug}