Assertion: filter's number | /r/HasProperty | duration
Facets:
Source sentences:
text: For example, the following will match an existing value in the message field for the given pattern, and if a match is found will add the field duration to the event with the captured value: filter { grok { match => { "message" => "Duration: %{NUMBER:duration}" } } } If you need to match multiple patterns against a single field, the value can be an array of patterns: filter { grok { match => { "message" =>