Logstash Technique For Multiple Field Names -


Hope to recreate my original question again that it is clear.

I have a log message that looks like this:

  13: 26: 24.160 Int 22000 Comprodbji: Interaction 065634563453 Here are some simple connected text _I_I_04776_E0 [07: 3F ]: 0 \ n _I_I_04776_E0 [09:04] assign: cfglist (LIST_VendorCfg) before VendorRoutine, data from key L1Only results v_L1Only (local) & lt; - STRING: \ "0 \" \ n _I_I_04776_E0 [07: 3F] data from cfglist (LIST_VendorCfg) before VendorRoutine, key enabling results: 1 \ n Assign _I_I_04776_E0 [09:04]: v_VendorEnabled (local) & lt; - STRING: \ "1 \" \ n _I_I_04776_E0 [09:04] Assign: V_AgentGroups (LOCAL) & lt; - STRING: \ "DAT_IN_NCL_JDOE @ .GA, VAG_IN_JDOE @ .GA \" \ n _I_I_04776_E0 [09:04] diagnosis: v_VQ (local) & lt; - STRING: \ "VQ_SCT_VENDOR_END \" \ n _I_I_04776_E0 [09:04] Assign: v_Stat (local) & lt; - STRING: Assign \ "StatTimeInReadyState \" \ n _I_I_04776_E0 [09:04]: v_Priority (local) & lt; - STRING: \ "10 \"  

I may need all the items except the insurance and I value.

Given the above message, I'm trying to find a way to remove the six ASSIGN field: -

ASSIGN: v_L1Only (LOCAL) & lt; - STRING: \ "0 \" \ n _I_I_04776_E0 [07: 3F] data from cfglist (LIST_VendorCfg) before VendorRoutine, key enabling results: 1 \ n _I_I_04776_E0 [09:04] Assign

: v_VendorEnabled (Local) & lt; - STRING: \ "1 \" \ n _I_I_04776_E0 [09:04]

Assign: v_AgentGroups (local) & lt; - STRING: \ "DAT_IN_NCL_JDOE @ .GA, VAG_IN_JDOE @ .GA \" \ n _I_I_04776_E0 [9:04]

Assign: v_VQ (local) & lt; - STRING: \ "VQ_SCT_VENDOR_END \" \ n _I_I_04776_E0 [09:04]

Assign: v_Stat (local) & lt; - STRING: \ "StatTimeInReadyState \" \ n _I_I_04776_E0 [09:04]

Orientation: v_Priority (LOCAL) & lt; - STRING: \ "10 \"

I've been trying to filter the 'KV' with different 'value_split' and 'field_split' characters - but is not getting anywhere fast.

Ideally I would like many assign fields with each of my values, but if the only way to allocate this unique area

Assume that there are names for each instance of an asset. If your example is all one line (if not, look in the multi-line codec), and you want to remove the values ​​before "ASSIGN", then you can give a regexp to "KV" (key / value) filter Which defines the separator. Here it is.


Comments