msg = event.get("message")
matches = msg.scan(/^([A-Za-z]+):(.*)/)
m = matches[0]
@@data[m[0]] = m[1]
The above code seems to be working fine when I run it separately. Also I removed
else if [message] =~ /^[ 0-9]+/ {
mutate { strip => [ "message" ] }
grok { match => { "message" => '^[0-9]{1,}[.][ +](?<key>[^:]+):\s*%{GREEDYDATA:value}' } }
ruby {
code => '
@@data[key] = value
'
}
drop{}
}
from the filter, still I get the same issue.