wheelq/Logstash.md

## Logstash.md

      
    Raw
  

              Logstash.md
            
          
    Logstash cheatsheet
mutate {
add_field => {"event_data.Suspicious" => "Suspicious Activity"}
}
--> Dest=>Values Adds field with data.
mutate {
add_field => {"event_data.Suspicious" => "[event_data][Foo]"}
}
--> Dest=>Src[value] Adds field with data from source
mutate {
copy => {"[event_data][Foo]" => "event_data.withdot" }
}
--> Src[value]=>Dest Copies values into Dest
mutate {
copy => {"[event_data][Foo]" => "[event_data][withbracket]" }
}
--> Src[value]=>Dest[hash] Copies values into Dest hash