Seperating fields in a string

Elastic Stack Logstash
1

Hello,

I will attempt this once more, hopefully somebody can help me out because I'm breaking my head over this one.

I'm using the throttle filter and I need to combine a string of fields I want to throttle.

throttle {
    before_count => -1
    after_count => 1
    period => 120
    max_age => 7200
    key => "%{temp}%{error}%EbNo%state"
    add_tag => "throttled"
  }

%{temp}%{error} works as intended, every unique value (e.g. error1, error2, error3) within the throttle window is saved but no same value is logged twice.

The problem is with the %EbNo%state. In this case I want to log ONE message PER field. However this string only logs ONE message regardless of the field. So instead of getting for example ebno: 20 and state: 30, only ebno is logged and state field value is ignored until the throttle period resets.

The docs offer no information from which I can deduct how the write the string I need.

Any help would be greatly appreciated. I went over about every type of string I could think of but whatever I do I never got the last part to work.

key
edit

This is a required setting.
Value type is string
There is no default value for this setting.

The key used to identify events. Events with the same key are grouped together. Field substitutions are allowed, so you can combine multiple fields.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.