I was hoping for some advice on how to handle the following, I'm not sure how to do it via query or logstash filter.
We have many different logs in the format below coming into Elasticsearch. The ActionSequenceId field correlates activity across the many logs. We've been asked to pull that data in and present it back as per the requested output.
I tried collecting this data via the logstash aggregate filter but because it's coming from many different sources, the ID fields are not reliably clustered. And for the life of me I can't seem to figure out the kind of query I need to build to pull this data out. I have not looked at Elasticsearch ingestion nodes but I'm headed there next.
Input This is going into Elasticsearch via the CSV filter w/o issue.
| INFO | 2017-01-09 06:29:45,414 | ActionSequenceId | Message | UserId | DocBaseCode | IPAddress | URI | FunctionName | ApplicationId | Exception |
| DEBUG | 2017-01-09 06:29:45,618 | 6361954018443 | entering | BOWKERR | SomeDocbaseCode | SomeIP | http://someurl | SomeFunctionName | SomeGuid | |
Can someone recommend an approach?