create virtual event?

[_asp_]

Hi,

Is it possible to create own / virtual events in logstash?
I intent to do the following:

1. I receive following log line:
timestamp, value_1, value_2, value_3

2. now I want to create 3 events out of it:

Code: Select all

1. @timestamp = timestamp
    value = value_1
2. @timestamp = timestamp
    value = value_2
3. @timestamp = timestamp
    value = value_3

This would workaround the fact, that I can only show multiple lines in a histogram for the same field name. So it does not work to store the values in separate fields with different names.

Thanks, Andreas

[hsmith]

Perhaps take a look at split. I have not worked with this, but it might do exactly what you're looking for: https://www.elastic.co/guide/en/logstas ... split.html

[_asp_]

thanks, split and clone are the filters which do the job

[mcapra]

Is it alright if we lock this thread and mark the issue as resolved?