Skip to content

Problem to split exec.stdout in Logstash #22

@diegopereiraeng

Description

@diegopereiraeng

Hello,

First of all thanks for developing this beats, it is very helpfull.

I'm facing some problems to parse exec.stdout in logstash.

I'm trying to split every newline in stdout as new event, but I'm receiving this error:
[WARN ][logstash.filters.split ] Only String and Array types are splittable. field:exec.stdout is of type = NilClass

it is what I tried in logstash:

filter {
if [type] == "netstat" {
json {
source => "exec.stdout"
}
mutate {
convert => ["exec.stdout", "string"]
}
split {
field => "exec.stdout"
}
}
}

I noticed that exec.stdout is a keyword format.

Could you help me?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions