Hi guys,
I have a scenario of events I need to match, the coming logstash messages
is like:
deviceId: aiken_2,
......
reading0: 0.235
reading1: 3.235
....
readingN: -235.3
The number of readings N varies from 1 to 24.
For each individual reading, I need a pattern to recognize its sequence
number, like pattern=reading(\d+), and I also need the deviceId of this
message. The deviceId and sequence number is passed to a perl script for
query purpose.
I cannot assign the 'deviceId' to a global variable using a Single rule and
use that variable in another rule that captures the reading sequence number
because when multiple messages are coming at high speed, the captured
'deviceId' might be inconsistent (wrong deviceId used for a node's
reading).
What is the best way for me to do this?
If I can not find an efficient solution in SEC to solve this, I can simply
change my input logstash message's format to:
...
aiken_2 reading0: 0.235
aiken_2 reading1: 3.235
....
aiken_2 readingN: -235.3
which will increase the message size I stored in my disk but will help me
capture the deviceId and sequence number at the same time.
Thanks!
------------------------------------------------------------------------------
Slashdot TV.
Video for Nerds. Stuff that matters.
http://tv.slashdot.org/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
