nput file:kvoptions.log
{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}
Configuration file:
input
{
file
{
path => “/home/murugar/Documents/kvoptions.log”
type => “file”
start_position => “beginning”
sincedb_path=> “/dev/null”
}
}
filter
{
grok
{
match => [“message”,"%{GREEDYDATA:msg}"]
}
kv
{
source => "msg"
field_split => ",\{\}"
value_split => ":"
exclude_keys => ["ConfigurationObjectType"]
}
}
output
{
stdout
{
codec => rubydebug
}
}
Obtained Ouput
{
“message” => “{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}”,
“@version” => “1”,
“@timestamp” => “2018-07-18T01:43:30.128Z”,
“path” => “/home/murugar/Documents/kvoptions.log”,
“host” => “0.0.0.0”,
“type” => “file”,
“msg” => “{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}”,
““Name”” => “admin”,
““ConfigurationObjectType”” => “ExecutionGroup”
}
Expected Ouput:
{
{
“message” => “{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}”,
“@version” => “1”,
“@timestamp” => “2018-07-18T01:43:30.128Z”,
“path” => “/home/murugar/Documents/kvoptions.log”,
“host” => “0.0.0.0”,
“type” => “file”,
“msg” => “{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}”,
““Name”” => “admin”,
}
}
In other word, the last bolded line should not appear. Why isnt exclude_keys working?