Remove timestamp where message have a string search?

Elastic Stack Elasticsearch
1

i have this

|2022-09-30 15:10:15,151 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:138)|
|---|---|
|2022-09-30 15:10:15,151 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:543)|
|2022-09-30 15:10:15,151 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:432)|
|2022-09-30 15:10:15,151 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:393)|
|2022-09-30 15:10:15,151 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)|
|2022-09-30 15:10:15,151 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:395)|
|2022-09-30 15:10:15,151 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:364)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:440)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:245)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:61)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at org.jboss.resteasy.resteasy-jaxrs@3.12.1.Final//org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)|
|2022-09-30 15:10:15,152 ERROR [stderr] (default task-4) |at javax.servlet.api@2.0.0.Final//javax.servlet.http.HttpServlet.service(HttpServlet.java:590)|

can be removed timestamp and insert all in 1 fields message multiline


filter {
    
 date {
       match => { "message" => "%[stderr] (default task%" }
  }
 
  mutate {
      remove_field => ['@timestamp']
  }
  
  
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.