Pipeline - Enrich log records

I am facing issue where our F5 logs carry 1 values which appears on application logs (CorrelationID) and Operator name which appears only on the F5 logs.
I would like to enrich the application logs with the operator name.
The shared value across those messages is the CorrelationID and I would like to enrich the application log records with Operator name which appears only on the F5 records.
How can I do that using pipelines ?

Maybe Bill Murrins slookup function will help?

Graylog Marketplace - SLOOKUP

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.