Create a field by message logstash

Question

I have a very simple message coming in my logstash, I want to create two fields that are inside this message.

if [message] =~ /.*My process: (?<myfield1>[A-Z]+) - (?<myfield2>[A-Z]+).*/ {
    mutate {
     add_field => [ "event_type", "eventType" ]
     add_tag => ["myTag"]
     add_tag => ["MySecondTag"]     } }

How can I create a field with the values field1 and field2?

Maybe you should consider reformatting your question so people can understand it better and help you. What about a complete example of what you want? Do you want 'myfield1' and 'myfield2' each to become a field, right? — Drubio

Marc-Antoine Jutras Marc-Antoine Jutras · Accepted Answer · 2019-02-07T18:39:00

You should consider changing your mutate filter to a grok filter

Logstash Grok Filter plugin

grok {
  id => "Parse_MyFields"
  match => { "message" => [ "/.*My process: %{WORD:myfield1} - %{WORD:myfield2}.*/" ] }
  }

This will set the 2 words your trying to extract into the "myfield1" field and "myfield2" field.

Be sure to validate your grok filter with a tool like Grok Constructor or Grok debugger

You can even use add_field with this plugin.

Create a field by message logstash

1 Answers