Closed weslambert closed 4 years ago
Logstash
:
mutate {
copy => { "file_ip" => "source_ip" }
}
Ingest
:
{
"set": {
"field": "source_ip",
"value": "{{file_ip}}"
}
}
Don't forget about elasticsearch ingest node parsing!
D'oh! Truth. - Added.
The ingest parser above resulted in errors. I had to change to:
{
"set": {
"field": "source_ip",
"value": "{{file_ip.0}}"
}
}
We should copy
file_ip
tosource_ip
so that we can build more congruent searches/tables, but retain the existingfile_ip
visualizations and dashboard config.