I need to handle multiple log formats: JSON, Apache and Tomcat format. It is very easy to handle each of them separately using JSON Extractor and Grok pattern.
But how to handle all of them in the same input? I have a GELF Input that receives these 3 types of log formats. The general format of GELF message is: @timestamp @version level container_name conainter_id image_name message (content can be JSON, Apache or Tomcat format) ... other fields For the JSON format, I need to rename the field 'level' to 'log_level' in order to avoid clashing with the GELF field with the same name. Could you please provide an example how to handle this? -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/e78fcb4a-1cd6-44ef-99bf-877404a0b1b1%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
