Correlate data name to text line // Lookup maybe ?

[klischatb]

Hello,

i have the following problem.
When i start my bukkit server (Minecraft) and join with a Player, the server will write i a log file with following text:

[12:56:48] [User Authenticator #1/INFO]: UUID of player PlayerName is 42a6cc6a-0253-4c65-baa2-74573573tds

In addition, he creates a file with the name of the UUID, for example:
42a6cc6a-0253-4c65-baa2-74573573tds.json
In this file everything is saved what the user has done on the server.

Example of the json file:

14.10.19 11:42:05,000   
{ [-]
   DataVersion: 1976
   stats: { [-]
     minecraft:crafted: { [-]
       minecraft:oak_planks: 4
     }
     minecraft:custom: { [+]
     }
     minecraft:killed_by: { [-]
       minecraft:creeper: 1
       minecraft:skeleton: 5
       minecraft:zombie: 12
     }
     minecraft:mined: { [-]
       minecraft:dirt: 7
       minecraft:grass: 38
       minecraft:grass_block: 24
       minecraft:oak_log: 2
       minecraft:poppy: 5
     }
     minecraft:picked_up: { [+]
     }
     minecraft:used: { [+]
     }
   }
}
Als Rohtext anzeigen
host = splunkcraft 
source = /home/splunker/minecraft/world/stats/42a6cc6a-0253-4c65-baa2-7457357cf96a.json
sourcetype = _json

Question:
Is it possible to Correlate the filename with the line from the log file.
I want this cause the .Json file dont have the Playername in it.

[gcusello · Accepted solution]

Hi klischatb,
when you ingest the UUID files, the filename is stored in the "source" field that can be used to correlate it to the the main log.
In other words you could have something like this:

index=my_index sourcetype=minecraft OR sourcetype=uuid
| rex field=source "^\/(\w*\/)*(?<uuid_source>[^\.]*).json$"
| ...

Ciao.
Giuseppe

[klischatb]

it helped a lot,
thank you