Hello. I'm trying to replace the content of the host field with part from message field. My message field contains something like that: message:<85>Jun 22 11:24:33 backup02.bla.domain.de sudo: ..... Now i wanna take " backup02.bla.domain.de " and put it in the "host" field. My filter currently is l…

Replace content of host field with part from message field

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Replace content of host field with part from message field