updated filter

duplocloud · Nov 28, 2024 · 4c47b82 · 4c47b82
1 parent 5cced8a
commit 4c47b82
Showing 1 changed file with 25 additions and 11 deletions.
diff --git a/diagnostics/opensearch/logstash/logstash.conf b/diagnostics/opensearch/logstash/logstash.conf
@@ -5,18 +5,32 @@ input {
 }
 
 filter {
-    json {
-        source => "message"
-        remove_field => ["message"]
-    }
-    split {
-        field => "records"
-    }
+  json {
+    source => "message"
+    remove_field => ["message"]
+  }
+
+  split {
+    field => "[records]"
+  }
+
+  date {
+    match => ["[records][time]", "MM/dd/yyyy HH:mm:ss"]
+    target => "@timestamp"
+  }
+
+  mutate {
+    remove_field => ["[records][time]"]
+  }
+
+  mutate {
+    remove_field => ["event.original"]
+  }
 }
 
 output {
-    opensearch {
-        hosts =>  ["${OPENSEARCH_HOST}:9200"]
-        index => "logstash-eventhub-%{+YYYY.MM.dd}"
-    }
+  opensearch {
+    hosts => ["${OPENSEARCH_HOST}:9200"]
+    index => "logstash-eventhub-%{+YYYY.MM.dd}"
+  }
 }