Is it possible to change a field by a previous value in logstash

Question

I'm searching on internet a way to put a variable in logstash and use or modify the value if a term is corresponding to a pattern.

Here, the is an example of my data source:

   2017-04-12 15:49:57,641|OK|file1|98|||
   2017-04-12 15:49:58,929|OK|file2|1387|null|msg_fils|
   2017-04-12 15:49:58,931|OK|file3|2|msg_pere|msg_fils|
   2017-04-12 15:50:17,666|OK|file1|25|||
   2017-04-12 15:50:17,929|OK|file2|1387|null|msg_fils|

I'm using this grok code to parse my source.

grok {
    match => {"message" =>  '%{TIMESTAMP_ISO8601:msgdates:date}\|%{WORD:verb}\|%{DATA:component}\|%{NUMBER:temps:int}\|%{DATA:msg_pere}\|%{DATA:msg_fils}\|'}
}

But in fact I want to modify the first field by the previous value of the line which contains file1

Can you tell me if it's possible or not?

Thanks

Answer 1

I have found a solution to my issue. I'm sharing you the solution to my problem. I'm using a plugin named logstash-filter-memorize, it can be install by the command :

logstash-plugin install logstash-filter-memorize

So my filter is like this :

grok {
    match => {"message" =>  '%{TIMESTAMP_ISO8601:msgdates:date}\|%{WORD:verb}\|%{DATA:component}\|%{NUMBER:temps:int}\|%{DATA:msg_pere}\|%{DATA:msg_fils}\|'}
}
if [component] =~  "file1" {
    mutate {
        add_field => [ "msg_id", "%{msgdates}" ]
    }
    memorize {
        fields => [ "msg_id" ]
        default => { "msg_id" => "NOTFOUND" } 
    }           }   
memorize {
    fields => [ "msg_id9" ]
}

I hope that it can be useful for others.