Hello,
My input file is a single line file which has multiple key Value pairs in it. Of them the field or Key “content” is the only one that is needed. I can drop the rest. The key/field “content” has a lot of events and it is those events, I need to send to ES. I have tried with Split, JSON, KV and also GROK without any success. When enabling debug mode, I see the “globbed files” entry on my input files. No issue with any permissions. Could not get any output so far. Any assistance is much appreciated.
Raw data >
{"queryId":-1,"last":false,"first":true,"totalElements":17804445,"numberOfElements":10,"totalPages":1780445,"size":10,"content":[{"id":"657261236","type":"BEV","system":["SST"],"actualStart":6017544370277667464,"actualEnd":1517289061000,"updated":1517289061601,"relevantStart":6017544370277667464,"relevantEnd":1517289061000,"apr":null,"status":"stop","origin":null,"title":"runTokCvv45 stop","peak":[],"risk":null,"severity":null,"owner":null,"summary":null,"irrLink":null,"investigators":[]},{"id":"55ab96b31","type":"BEV","system":["NON"],"actualStart":55237046401000,"actualEnd":1517601601000,"updated":1517601601051,"relevantStart":55237046401000,"relevantEnd":1517601601000,"apr":null,"status":"malware start","origin":null,"title":"malware start","peak":[],"risk":null,"severity":null,"owner":null,"summary":null,"imrPmrLink":null,"investigators":[]}],"number":0,"_links":{"self":{"href":"http://abc/abc?page=0&queryId=-1&size=10"},"next":{"href":"http://abc/abc?page=1&queryId=-1&size=10"},"first":{"href":"http://abc/abc?page=0&queryId=-1&size=10"},"last":{"href":"http://abc/abc?page=1780444&queryId=-1&size=10"}}}
Logstash config >
input{
file {
path => "/home/admin//testbare.txt"
start_position => "beginning"
sincedb_path => "/home/admin/lsin/db"
}
}
filter {
json { source => "message" }
kv {
value_split => ":"
field_split => ","
include_keys => [ "content" ]
recursive => "true"
}
}
output {
stdout { codec => rubydebug }
}
Regards