extractor-nsxedge.json

{
  "extractors": [
    {
      "title": "nsxedge_get_json",
      "extractor_type": "json",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "",
      "extractor_config": {
        "list_separator": ", ",
        "kv_separator": "=",
        "key_prefix": "nsxedge_",
        "key_separator": "_",
        "replace_key_whitespace": false,
        "key_whitespace_replacement": "_"
      },
      "condition_type": "none",
      "condition_value": ""
    },
    {
      "title": "nsxegde_text_grok",
      "extractor_type": "grok",
      "converters": [],
      "order": 1,
      "cursor_strategy": "copy",
      "source_field": "nsxedge_text",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{NSXEDGE_SYSLOG}",
        "named_captures_only": true
      },
      "condition_type": "none",
      "condition_value": ""
    },
    {
      "title": "timestamp_from_iso",
      "extractor_type": "copy_input",
      "converters": [
        {
          "type": "date",
          "config": {
            "date_format": "yyyy-MM-dd'T'HH:mm:ss.SSS",
            "time_zone": "UTC",
            "locale": "und"
          }
        }
      ],
      "order": 2,
      "cursor_strategy": "copy",
      "source_field": "nsxedge_timestamp_iso",
      "target_field": "timestamp",
      "extractor_config": {},
      "condition_type": "none",
      "condition_value": ""
    },
    {
      "title": "nsxedge_message_grok",
      "extractor_type": "grok",
      "converters": [],
      "order": 9,
      "cursor_strategy": "copy",
      "source_field": "nsxedge_message",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{NSXEDGE_INET}",
        "named_captures_only": true
      },
      "condition_type": "none",
      "condition_value": ""
    }
  ]
}