# A question about separator in logstash
**URL:** https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427
**Category:** Logstash
**Created:** [July 3, 2023, 9:04am UTC](https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427 "2023-07-03T09:04:31Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@caixukun](https://discuss.elastic.co/u/caixukun)
#### Post date: [July 3, 2023, 9:04am UTC](https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427/1 "2023-07-03T09:04:32Z")
my data is:
123456@gmail.com----john----password
123456@gmail.com----john----p@ssword
123456@gmail.com----john----123456
123456@gmail.com----john----123456
123456@gmail.com----john----123----456
123456@gmail.com----john----123456
my separator is :
separator =\> "----"
After I use logstash to import data, an error will appear,Because the same thing as separator appears in the data
So I would like to ask you how to solve this error
Thanks
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 3, 2023, 9:22am UTC](https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427/2 "2023-07-03T09:22:38Z")
Welcome to the community!
Can you show the pattern or all filter section?
---
### Author:  [@caixukun](https://discuss.elastic.co/u/caixukun)
#### Post date: [July 3, 2023, 9:28am UTC](https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427/3 "2023-07-03T09:28:03Z")
this is all
```auto
input {
file {
path => ["/test.txt"]
start_position => beginning
sincedb_path => "/test_.txt"
codec => plain{
charset=>"UTF-8"
}
}
}
filter {
mutate{
gsub => ["message", "\\r", ""]
}
csv {
separator => "----"
columns => ["email","name","password"]
remove_field => ["host", "tags", "path", "message","@timestamp","@version"]
}
}
output {
elasticsearch {
hosts => ["https://localhost:9200"]
index => "test"
user => "elastic"
password => "123456"
cacert => "/opt/kibana-8.8.0/data/ca_1685641330385.crt"
}
}
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 3, 2023, 9:32am UTC](https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427/4 "2023-07-03T09:32:20Z")
Will not work.
Try with dissect or grok.
```auto
dissect {
mapping => {
"message" => "%{email}----%{name}----%{password}"
}
}
```
Btway, I wouldn't remove fields: "tags", "@timestamp","@version"
---
### Author:  [@caixukun](https://discuss.elastic.co/u/caixukun)
#### Post date: [July 3, 2023, 9:58am UTC](https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427/5 "2023-07-03T09:58:39Z")
Thank you sir, by the way, why don't you remove "tags", "@timestamp", "@version" , if you don't remove it, will it take up more storage?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 3, 2023, 11:44am UTC](https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427/6 "2023-07-03T11:44:42Z")
- "tags" are useful for error handling and to know what is wrong as `_dissectfailure` or `_grokparsefailure` for grok plugin in [tags](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html#plugins-filters-dissect-tag_on_failure)
Error handling:
```auto
output {
if "_dissectfailure" in [tags] {
elasticsearch {
hosts => ["https://localhost:9200"]
index => "error_-%{+YYYY.MM.dd}"
cacert => "/opt/kibana-8.8.0/data/ca_1685641330385.crt"
}
}
else {
elasticsearch {
hosts => ["https://localhost:9200"]
index => "test"
cacert => "/opt/kibana-8.8.0/data/ca_1685641330385.crt"
}
}
}
```
- "@timestamp" to know when something has been processed
- "@version" it's not mandatory, but it's useful. There is a discussion [here](https://github.com/elastic/logstash/issues/3866).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 31, 2023, 11:45am UTC](https://discuss.elastic.co/t/a-question-about-separator-in-logstash/337427/7 "2023-07-31T11:45:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.