Hello,
i have the following problem.
When i start my bukkit server (Minecraft) and join with a Player, the server will write i a log file with following text:
[12:56:48] [User Authenticator #1/INFO]: UUID of player PlayerName is 42a6cc6a-0253-4c65-baa2-74573573tds
In addition, he creates a file with the name of the UUID, for example:
42a6cc6a-0253-4c65-baa2-74573573tds.json
In this file everything is saved what the user has done on the server.
Example of the json file:
14.10.19 11:42:05,000
{ [-]
DataVersion: 1976
stats: { [-]
minecraft:crafted: { [-]
minecraft:oak_planks: 4
}
minecraft:custom: { [+]
}
minecraft:killed_by: { [-]
minecraft:creeper: 1
minecraft:skeleton: 5
minecraft:zombie: 12
}
minecraft:mined: { [-]
minecraft:dirt: 7
minecraft:grass: 38
minecraft:grass_block: 24
minecraft:oak_log: 2
minecraft:poppy: 5
}
minecraft:picked_up: { [+]
}
minecraft:used: { [+]
}
}
}
Als Rohtext anzeigen
host = splunkcraft
source = /home/splunker/minecraft/world/stats/42a6cc6a-0253-4c65-baa2-7457357cf96a.json
sourcetype = _json
Question:
Is it possible to Correlate the filename with the line from the log file.
I want this cause the .Json file dont have the Playername in it.
Hi klischatb,
when you ingest the UUID files, the filename is stored in the "source" field that can be used to correlate it to the the main log.
In other words you could have something like this:
index=my_index sourcetype=minecraft OR sourcetype=uuid
| rex field=source "^\/(\w*\/)*(?<uuid_source>[^\.]*).json$"
| ...
Ciao.
Giuseppe
Hi klischatb,
when you ingest the UUID files, the filename is stored in the "source" field that can be used to correlate it to the the main log.
In other words you could have something like this:
index=my_index sourcetype=minecraft OR sourcetype=uuid
| rex field=source "^\/(\w*\/)*(?<uuid_source>[^\.]*).json$"
| ...
Ciao.
Giuseppe
it helped a lot,
thank you