Regex on matched field

Elastic Stack Logstash
1

I have a grok filter which is:

grok {
		  match => [ "message", "^(\s+)?%{TIMESTAMP_ISO8601:logtime}%{SPACE}\|%{SPACE}\[%{NUMBER:thread_id}\]%{SPACE}\|%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\|%{SPACE}%{GREEDYDATA:classname}%{SPACE}\|%{SPACE}%{GREEDYDATA:logmessage}"]  
	   }

Now I further want to apply regex on classname and do furthur classification. How can I do that?

2

This basically tells us nothing. What's an example entry of the classname field?

In principle, you can have another grok filter further down the line that only applies to that field.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.