How to add a new dynamic value(which is not there in input) to logstash output? -
my input has timestamp in format of apr20 14:59:41248 dataxyz. in output need timestamp in below format: **day month monthday hour:minute:second year dataxyz **. able remove timestamp input. not quite sure how add new timestamp.
i matched message using grok while receiving input: match => ["message","%{word:word} %{time:time} %{greedydata:content}"]
i tried using mutate add_field.but not successful in adding value of day. add_field => [ "timestamp","%{day}"]
.i got output word ´day´ , not value of day. can please throw light on being missed.
you need grok out individual named fields, , can reference fields in add_field.
so grok start this:
%{month:month}%{monthday:mday}
and can put them this:
mutate { add_field => { "newfield" => "%{mday} %{month}" } }
Comments
Post a Comment