crowdsec/pkg/parser/tests/base-json-extract/base-grok.yaml

15 lines
329 B
YAML
Raw Normal View History

2020-05-22 16:12:33 +00:00
filter: "evt.Line.Labels.type == 'json-1'"
debug: true
onsuccess: next_stage
name: tests/base-json-extract
statics:
- parsed: message
expression: JsonExtract(evt.Line.Raw, "log")
- meta: other_field
expression: JsonExtract(evt.Line.Raw, "testfield")
- meta: program
expression: evt.Line.Labels.progrname