Referring a multi level field in Logstash

Elastic Stack Logstash
1

Hi,

I would like to to do an output to a syslog when a fieldname with the name symantec_endpoint.log.event_description equals to "The....successfully"

The way that I refer the field in my code is not working, need help~!

output {
  if [symantec_endpoint][log][event_description] == "The management server received the client log successfully" {
      syslog {
        host => "196.60.0.22"
        port => 514
        rfc => [ "rfc5424" ]
        protocol => [ "tcp" ]
        appname => "Elastic Stack"
        message => "messssssagesssss"
        facility => "appnameeee"
        codec => "plain"
        priority => "priorityyyyy"
        severity => "serverityyyyy"
        sourcehost => "sourcehosttttt"
        reconnect_interval => "60"
        enable_metric => false
        procid => "procidddddd"
      }
  }
}
2

Please show a sample event that you would expect to match the criteria.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.