FYI: I have not tested this config, but I hope you get the general idea.
Use a grok filter to figure out if it matches the pattern.
If it does match (_grokparsefailure is NOT thrown) then replace the event with "anonym".
If _grokparsefailure IS thrown then you know that there is no path in your event field.
Then always remove _grokparsefailure tag.
grok {
match => {"event" => "%{PATH}"}
}
if "_grokparsefailure" not in ["tags"] {
mutate {
replace => {"event" => "anonym"}
}
}
mutate {
remove_tag ["_grokparsefailure"]
}
I thought that the field was called "event". You have to replace the field with whatever you want inside of it, there is no easy way to just replace a path inside of a field. If you want to do that you'll have to do some ruby coding and fancy regex.
Yes, that's what I've tried at the top. I've tested the regex and it should work. But nothing happens at all. I don't know what's wrong with my ruby code.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.