+ else if [source] == "/var/log/onap/aai/aai-ml/audit.log" {
+ csv {
+ source => "message"
+ separator => "|"
+ quote_char => "`"
+ columns => ["Begin TS", "End TS", "DuplicateRequestID", "Unknown1", "threadID", "phys/virt server name", "service name", "Partner Name", "Unknown2", "Unknown3", "Unknown4", "Unknown5", "Log level", "Unknown6", "Unknown7", "Status code", "Server", "Unknown10", "Unknown11", "Unknown12", "Unknown13", "Unknown14", "Unknown15", "Unknown16", "Unknown17", "message"]
+ }
+ }
+
+ mutate {
+ remove_field => ["DuplicateRequestID", "Unknown1", "Unknown2", "Unknown3", "Unknown4", "Unknown5", "Unknown6", "Unknown7", "Unknown8", "Unknown9", "Unknown10", "Unknown11", "Unknown12", "Unknown13", "Unknown14", "Unknown15", "Unknown16", "Unknown17", "Unknown18"]
+ }
+
+ if ([source] == "/var/log/onap/sdc/sdc-be/audit.log") {
+ #Parse kvps in message
+ kv {
+ field_split => "\s"
+ trim_key => "\s"
+ trim_value => "\s"
+ }
+
+ #If Request Id is missing and DID is present use as RequestId
+ if (![RequestId] and [DID] =~ /.+/) {
+ mutate { add_field => { "RequestId" => "%{DID}" } }
+ }
+ }
+
+ } #Close else statement for logback events
+} #Close filter