elasticsearch - Logstash: create new event in filter -


when filtering events in logstash (20+ attributes) create new event have 1 parameter original event , store other elastisearch index.

i know possible using clone filter plugin. don't want manually remove attributes original events except 1 need.

also clone event (i'm store new event in separate elasticsearch index) duplicate unneeded attributes.

is there filter plugin purpose? or hidden feature? or maybe clone filter plugin handles removal of attributes cloned messages?

elastalert simple framework alerting on anomalies, spikes, or other patterns of interest data in elasticsearch.

http://elastalert.readthedocs.io/en/latest/elastalert.html


Comments

Popular posts from this blog

How has firefox/gecko HTML+CSS rendering changed in version 38? -

javascript - Complex json ng-repeat -

jquery - Cloning of rows and columns from the old table into the new with colSpan and rowSpan -