Nagios Support Forum

Posted: **Mon Jun 20, 2016 8:51 am**

Hi,

Is it possible to create own / virtual events in logstash?
I intent to do the following:

1. I receive following log line:
timestamp, value_1, value_2, value_3

2. now I want to create 3 events out of it:

Code: Select all

1. @timestamp = timestamp
    value = value_1
2. @timestamp = timestamp
    value = value_2
3. @timestamp = timestamp
    value = value_3

This would workaround the fact, that I can only show multiple lines in a histogram for the same field name. So it does not work to store the values in separate fields with different names.

Thanks, Andreas

Posted: **Mon Jun 20, 2016 12:46 pm**

Perhaps take a look at split. I have not worked with this, but it might do exactly what you're looking for: https://www.elastic.co/guide/en/logstas ... split.html

Posted: **Wed Jun 29, 2016 4:56 am**

thanks, split and clone are the filters which do the job

Posted: **Wed Jun 29, 2016 9:31 am**

Is it alright if we lock this thread and mark the issue as resolved?

Nagios Support Forum

create virtual event?

create virtual event?

Re: create virtual event?

Re: create virtual event?

Re: create virtual event?