how to match multiple fields using translate filter?
Please provide more information on what you are trying to achieve.
What do you mean by [quote="Kishore, post:1, topic:56359"]
multiple fields
[/quote]
I want to generate an alert if there is any change in User Country from the below mentioned scenario.
Log looks like below:
Jul 25 07:18:24 ip-10-129-23-37 openvpn[69098]: kishore/170.24.6.84:19412 MULTI_sva: pool returned IPv4=13.24.129.30, IPv6=(Not enabled)
I was able to capture Username: kishore and Country Name: India/USA from the above log to store in the Dictonary file to match, i am trying to match both fields in the log if log occurs second time.
If i could be able to match and find there is any change in Country , i want to generate an alert.
You are better off using Alerting (Watcher) or similar.
Else can you please suggest me that how to merge two fields
filter {
mutate {
add_field => {
"new_field" => "%{field1} %{field2}"
}
}
}
Hope this helps!
Thanks Buster.