I would like to export the hostname in the raw log and then I would like to add this to “hostname” field.
I am testing to use “pipeline feature” and “rules”. However, I think that I do not have enough skill to make expression rule to export and set the hostname. Could you please help my issue? It will be very helpful.
For example> Here is the raw log from the network device of Cisco. As you can see that the real hostname is “dc1-chint-lf-1218” and it can be changed each appliance. (dc1-chint-lf-1218 or dc1-chint-lf-1219 or dc2-chint-lf-1000)
[As-IS]
Custom Message:
time : 2022-05-06T07:35:47.000Z hostname : 913 message : 913 dc1-chint-lf-1218 %LOG_LOCAL7-4-SYSTEM_MSG [F96760][raised][threshold-crossed][warning][sys/phys-[eth1/9]/fault-F96760] TCA: Egress Buffer Drop Packets rate(eqptEgrDropPkts5min:bufferRate) value 13 raised above threshold 10 severity : 4
[To-BE]
Custom Message:
time : 2022-05-06T07:35:47.000Z hostname : dc1-chint-lf-1218 message : 913 dc1-chint-lf-1218 %LOG_LOCAL7-4-SYSTEM_MSG [F96760][raised][threshold-crossed][warning][sys/phys-[eth1/9]/fault-F96760] TCA: Egress Buffer Drop Packets rate(eqptEgrDropPkts5min:bufferRate) value 13 raised above threshold 10 severity : 4
I am sorry that my explanation is not enough to share what I want. Sure, I will study more to use grok, just now I can use only pipeline rule.
My idea is… this can be solved this if I can export specific word and set this to the string. As you can see, “dc1-chint-lf-1218” is the second block in the log. If I can export the second block word to the specific string($hostname), I can solve this. How do you think this?
time : 2022-05-06T07:35:47.000Z hostname : 913 message : 913 dc1-chint-lf-1218 %LOG_LOCAL7-4-SYSTEM_MSG [F96760][raised][threshold-crossed][warning][sys/phys-[eth1/9]/fault-F96760] TCA: Egress Buffer Drop Packets rate(eqptEgrDropPkts5min:bufferRate) value 13 raised above threshold 10 severity : 4