+8I am looking at the logstash filters in the following parser extension documentation:
json {
source => "message"
array_function => "split_columns"
}
2. can you please explain what does `"@output" => "event" do? - what does it mean to say bind the udm fields to @output key.
mutate {
merge => {
"@output" => "event"
}
}
Best answer by reapzor
Hi there!
As said in the other post: the array_function defines how it needs to process a json array see this page for an example: https://cloud.google.com/chronicle/docs/reference/parser-syntax#manipulating_json_arrays
You normally build up a parser by
1. splitting up the raw message into parameters that you can use
2. add those parameters to UDM fields (typically set to an "event" variable, but you could name it whatever you want"
3. merge the event with the already existing output
The final step is the one that is done in the mutate/merge statement.
array_function => "split_columns"
// this is used to split nested arrays into column. e.g. if your src.ip field is an array and having multiple ips. It will split into columns that you'll be able to access it like src.ip.0, src.ip.1 ... src.ip.n
Below configuration is needed to merge all the etl you are doing in a parser to an event. PS- event is a reserved keyword
mutate {
merge => {
"@output" => "event"
}
}
+3Hi there!
As said in the other post: the array_function defines how it needs to process a json array see this page for an example: https://cloud.google.com/chronicle/docs/reference/parser-syntax#manipulating_json_arrays
You normally build up a parser by
1. splitting up the raw message into parameters that you can use
2. add those parameters to UDM fields (typically set to an "event" variable, but you could name it whatever you want"
3. merge the event with the already existing output
The final step is the one that is done in the mutate/merge statement.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
