@Christian_Dahlqvist Thank you ! CSV filter is easier to use than grok (who ask value type ect....)
I have a question about csv filter !
if [type] == "test_edr" {
csv {
columns => [ ".,..,..,..,.." ]
separator => ","
}
Whats delete line header ? With an If or somethings like it ?
Tooo I try to convert fields, I have try this :
mutate {
convert => { "edr_UsedTotalOctets" => "integer", "edr_GrantedTotalOctets" => "integer", "edr_Usage-Limit" => "integer" }
}
Maybe i must declare somes mutate for one field ?
It's doesn't work.
Thank for your help @Christian_Dahlqvist