I have compress file that contain several files. in source just show compress file. e.g compress files name is log.bz2, it contain log1 log2 log3
currently in source just show log.bz2 , how can I find which event belong to which file?
something like this log.bz2 > log2
How did you define your monitor input? What kind of archive is log.bz2? Source would typically have a value like /path/to/log.bz2:./log1, /path/to/log.bz2:./log2, /path/to/log.bz2:./log3, etc.
To replace source with the archived source path:
| rex field=source ":(?!\\\\)(?<source>.*)"
To replace source with the archived source file:
| rex field=source ".*[\\\\/](?<source>.*)"