Substitute GROK by dissect: test of writing

I want to substitute a grok filter by a dissect
In a few words, i want replace this grok filter

grok {
match => { "[raw_syslog_result][syslog_message]" => [

by this one

mapping => {
"THREAT" => "{%threat_type} {%generate_time} {%source_ip}{%dest_ip}{%threat_contentname}{%threat_category}"

i've doubt on the syntax: is that correct?

Should be like this:

 dissect {
	mapping => {
        "[raw_syslog_result][syslog_message]" => "THREAT,%{threat_type},%{generate_time} %{source_ip},%{dest_ip},%{},%{},(put %{}enough times),%{threat_contentname},%{threat_category},%{}"

Also you can use CSV plugin for that. Something like this:

     source => "[raw_syslog_result][syslog_message]"
     columns => ["THREAT","threat_type", "generate_time"... ] # add other column names
     skip_empty_columns => true
     skip_empty_rows => true

nice! it works

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.