Taking care of syslog PRI header in filter

Elastic Stack Logstash
1

I use kv filter on a syslog data on the form key1=value1 key2=value2 etc.

However, every syslog row has a leading PRI header of key1=value1.

Is there a way to:

  1. Parse the pri header and all key-value pairs.

  2. Remove the pri header and parse the key-value pairs?

current filter is just

filter { kv {} }

Thank you very much for your support!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.