Hello,
First of all thanks for developing this beats, it is very helpfull.
I'm facing some problems to parse exec.stdout in logstash.
I'm trying to split every newline in stdout as new event, but I'm receiving this error:
[WARN ][logstash.filters.split ] Only String and Array types are splittable. field:exec.stdout is of type = NilClass
it is what I tried in logstash:
filter {
if [type] == "netstat" {
json {
source => "exec.stdout"
}
mutate {
convert => ["exec.stdout", "string"]
}
split {
field => "exec.stdout"
}
}
}
I noticed that exec.stdout is a keyword format.
Could you help me?
Hello,
First of all thanks for developing this beats, it is very helpfull.
I'm facing some problems to parse exec.stdout in logstash.
I'm trying to split every newline in stdout as new event, but I'm receiving this error:
[WARN ][logstash.filters.split ] Only String and Array types are splittable. field:exec.stdout is of type = NilClass
it is what I tried in logstash:
filter {
if [type] == "netstat" {
json {
source => "exec.stdout"
}
mutate {
convert => ["exec.stdout", "string"]
}
split {
field => "exec.stdout"
}
}
}
I noticed that exec.stdout is a keyword format.
Could you help me?