Upsert a document with unique id but same fields and different values

Elastic Stack Logstash
1

Hi,

I have two events with same id idRda like the following, I need to unify the logs in one document, but adding two fields "timestamp1" and "timestamp2"

example:
idRda:[4040477]
timestamp1:[1670939520399]
timestamp2:[1670939526203]

"message": "2022-12-13 14:52:00.399 {[ACTIVE] ExecuteThread: 5 for queue: weblogic.kernel.Default (self-tuning)} INFO idRda:[4040477] timestamp:[1670939520399]",
"message": "2022-12-13 14:52:06.203 {[ACTIVE] ExecuteThread: 12 for queue: weblogic.kernel.Default (self-tuning)} INFO idRda:[4040477] timestamp:[1670939526203]",

Thank you
Regards

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.