Input Extractor: change field value based on _another_ field

Have some logs coming from Docker containers via GELF UDP.

Messages in question are:

level: 6
message: .* PHP Fatal error: .*

I can process them by routing to a new stream and pipeline in it, but don’t think it’s the right way to do it. Moreover, I need them to be in already existing stream.

how to set up an extractor, that by matching message field, would set a specific value to level field?

PS: and that’s completely another question why Dev’s didn’t catch and log those exception properly :slight_smile:

the processing pipeline is build to solve your problem.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.