Hi guys,
I’ve been stuck on this for a few days and could use some help.
What I’m trying to do is reference the value of metadata.event_type that’s set by the prebuilt parser and then use that value in an IF condition within a parser extension.
Below is a simple example of what I’m attempting to do.
Any guidance or clarification would be really appreciated.
Thanks!
Prebuilt parser:
metadata.event_type: USER_LOGIN
Parser Extension:
filter {
if ["event.idm.read_only_udm.metadata.event_type"] == "USER_LOGIN" {
mutate {
replace => {
"event.idm.read_only_udm.metadata.description" => "Fujiko"
}
}
}
mutate {
merge => {
"@output" => "event"
}
}
}
Since the IF condition is met, metadata.description should be populated with “Fujiko”.
This is being done in Google Chronicle.
