CODEWITHSUNDEEP
loggingdatadog
Eva
Eva

Reputation: 593

How to combine two varibles in grok parser

My log Sample:

Process Process[spinup-app-3,5,main] has been running for 9740 ms, time limit is 2000 ms

My Current Grok Praser

rule1 Process\s+Process\[%{data:appName}-%{integer:appID},%{integer:Count},main\]\s+%{data}\s%{number:duration}\s+%{data}\s%{number:duration}\s+ms

Current Output
{
  "duration": [
    9740,
    2000
  ],
  "appName": "spinup-app",
  "appID": 3,
  "Count": 5
}

I want to combine appName and appID to form task (Like shown below) how can I achieve this?

desired Output
{
  "duration": [
    9740,
    2000
  ],
  "task": "spinup-app-3"
  "appName": "spinup-app",
  "appID": 3,
  "Count": 5
}

Upvotes: 0

Views: 351

Answers (1)

draav
draav

Reputation: 1943

Add a String Builder Processor after your Grok Parser in your pipeline to create the task attribute.

%{appName}-%{appID}

Upvotes: 1

Related Questions