Trying to use the "memorize" plugin like so:
if [message] =~ /matching event/ {
grok {
match => [ "message", "%{mymatch:datetime}" ]
}
memorize {
field => [datetime]
}
}
if [message] =~ /another event/ {
mutate {
add_field => {
datetime => "%{datetime}"
}
}
}
A field called datetime is being added, but it only contains the text "%{datetime}". Clearly I'm using the plugin incorrectly. Can anyone advise on how to reference the memorized value please?
Thanks.
The way that plugin works would be like this:
if [message] =~ /matching event/ {
grok {
match => [ "message", "%{mymatch:datetime}" ]
}
}
# either save the datetime or add it based on last value
memorize {
field => 'datetime'
default => '00:00:00'
}
if [message] =~ /another event/ {
# datetime has already been added based on the above line
}
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.