-
Notifications
You must be signed in to change notification settings - Fork 28
Open
Description
Hello,
First of all thanks for developing this beats, it is very helpfull.
I'm facing some problems to parse exec.stdout in logstash.
I'm trying to split every newline in stdout as new event, but I'm receiving this error:
[WARN ][logstash.filters.split ] Only String and Array types are splittable. field:exec.stdout is of type = NilClass
it is what I tried in logstash:
filter {
if [type] == "netstat" {
json {
source => "exec.stdout"
}
mutate {
convert => ["exec.stdout", "string"]
}
split {
field => "exec.stdout"
}
}
}
I noticed that exec.stdout is a keyword format.
Could you help me?
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels