Input Extractor: change field value based on _another_ field


(Alex P) #1

Problem
Have some logs coming from Docker containers via GELF UDP.

Messages in question are:

level: 6
message: .* PHP Fatal error: .*

I can process them by routing to a new stream and pipeline in it, but don’t think it’s the right way to do it. Moreover, I need them to be in already existing stream.

Goal
how to set up an extractor, that by matching message field, would set a specific value to level field?

PS: and that’s completely another question why Dev’s didn’t catch and log those exception properly :slight_smile:


(Jan Doberstein) #2

the processing pipeline is build to solve your problem.