How to add a new dynamic value(which is not there in input) to logstash output? -


my input has timestamp in format of apr20 14:59:41248 dataxyz. in output need timestamp in below format: **day month monthday hour:minute:second year dataxyz **. able remove timestamp input. not quite sure how add new timestamp.

i matched message using grok while receiving input: match => ["message","%{word:word} %{time:time} %{greedydata:content}"]

i tried using mutate add_field.but not successful in adding value of day. add_field => [ "timestamp","%{day}"].i got output word ´day´ , not value of day. can please throw light on being missed.

enter image description here

you need grok out individual named fields, , can reference fields in add_field.

so grok start this:

%{month:month}%{monthday:mday} 

and can put them this:

mutate {     add_field => {         "newfield" => "%{mday} %{month}"     } } 

Comments

Popular posts from this blog

javascript - Using jquery append to add option values into a select element not working -

Android soft keyboard reverts to default keyboard on orientation change -

Rendering JButton to get the JCheckBox behavior in a JTable by using images does not update my table -