Log Transformation & Enrichment
Selective forwarding of logs with filters. Log transformation with computed data or Log enrichment with new attributes - using grok patterns
Advanced Usage
The previous example doesn't show how to parse the correct timestamp or how to ship multi-line logs. These are important issues that can easily be addressed.
To get started, let's assume our logs contain a timestamp (UTC), severity and message. If your logs have different structure you'll need to make small adjustments to the configs below.
2015-10-03 12:01:58,345 ERROR Processing request failed.
Multi-line messages require a slight changed input section.
Last updated