How to merge event fields by ID？ | Log collection solutions

#1 hugh_yang 3 years ago

Hi. I have a problem that I can't find a solution.

use IM_ File entered some text as follows

[20210816-094441] ID=123  some information1
[20210816-094441] ID=123  some information2
[20210816-094441] ID=124  some information3
[20210816-094441] ID=124  some information4

need to merge events according to the ID field. The expected output is as follows. I find some data and try to use PM_ Evcorr, but the community version lacks get_ prev_ event_ data()

[20210816-094441] ID=123  some information1 some information2
[20210816-094441] ID=124  some information3 some information4

Permalink

#2 ArkadiyDeactivated Nxlog ✓ 3 years ago

#1 hugh_yang

Hi. I have a problem that I can't find a solution. use IM_ File entered some text as follows [20210816-094441] ID=123 some information1 [20210816-094441] ID=123 some information2 [20210816-094441] ID=124 some information3 [20210816-094441] ID=124 some information4 need to merge events according to the ID field. The expected output is as follows. I find some data and try to use PM_ Evcorr, but the community version lacks get_ prev_ event_ data() [20210816-094441] ID=123 some information1 some information2 [20210816-094441] ID=124 some information3 some information4

Hello.

To do so on Community version you could try to use xm_exec or xm_perl to invoke side scripts and process events via them.
Don't think there's other options around in this particular case.

Regards, Arch