Hi
I want to use a fieldname to setup the "target" field in KV plugin, but it's doesn't work
filter {
if [message] =~ /^NUMBER OF .*:/ {
grok {
match => { "message" => "^NUMBER OF %{DATA:fieldinfo} :"}
}
mutate {
gsub => [ "fieldinfo", " ", "_" ]
}
kv {
field_split => "\n"
target => "NB_%{fieldinfo}"
trim => " "
trimkey => " <>"
}
} else {
drop{}
}
}
my result :
{
"path" => "/tmp/input",
"@timestamp" => 2017-03-09T15:15:09.147Z,
"NB_%{fieldinfo}" => {
"NamedUsers" => "24488",
"Groups" => "16781"
},
"@version" => "1",
"host" => "XXXXX",
"fieldinfo" => "USERS_AND_GROUPS",
"message" => "NUMBER OF USERS AND GROUPS :\n Named Users = 24488 \n Groups = 16781 \n ",
"tags" => [
[0] "multiline"
]
}
Any idea ?
Thanks
Florent