1st quesion:
source filename: /home/elk/hzam_1_perf.log,i want only get hzam,how to slove? Is there any other way??
2nd question:
log content:
07/20/20 00:00:08 INFO infocity:sh(city/CityInfoBusiness.cpp:134)
The final field that i want to enter into ES
07/20/20 00:00:08 INFO infocity:sh hzam(1st can get)
07/20/20 00:00:08 the date format how to filter match