Thank you always for your help.
Sample Log
11:04:14.371 [START] [PM_PROCESS_CONTROL]
11:04:14.375 [END] [PM_PROCESS_CONTROL]
I want to change the values to put them into the DB as shown below.
- In the case of [START], value is the ‘0’
- In the case of [END], value is the ‘1’
[inputs.logparser.grok]
custom_patterns = '''
TIMESTAMP_ALT %{HOUR}:%{MINUTE}:%{SECOND}(.[0-9])
STATUS (\[START\]|\[END\])
HW (PROCESS)
PART (\[PM_"%{HW:f2}"_CONTROL\])
'''
patterns = ['%{TIMESTAMP_ALT:time:ts-"15:04:05"}\t%{STATUS:da} %{PART} %{GREEDYDATA:trash}']
Config above is shown below.
Result1 => da : [START] f2 : PROCESS
Result2 => da : [EBD] f2 : PROCESS
But, I wanna Result => da : ‘0’ f2 : Process
I was successful in putting the original data into the DB as above.
But i want to change the value.
Are there any grammar rules that change the collected data before it is put into the DB?
Thank you !!!