Add new Field in Logstash

I have this csv file which look like this
Insert Time :13/05/2019 0:00:54,
Mobile : 923xxxxxxxxx,
Telco: Mobilink,
Mask : 6222
Message : Your MCB Debit Card has been charged PKR xx

I want to find logstash the message field to find MCB Debit Card and add into new Column Card Type

I have this config file but its not running can someone help

input
{
file
{
path => "D:/kibanaproject/ubaid.csv"
start_position => "beginning"
sincedb_path => "NUL"
}
}
filter {
if [Message] =~ "/MCB/"{
mutate {
add_field => {"CardType"}
}
csv {
separator => ","
columns => ["Insert_time","Mobile","Telco","Mask","Message"]
}
date {
match => ["Insert_time","dd-MM-YYYY HH:mm"]
target => "Insert_time"
}

output {
elasticsearch {
hosts => ["localhost:9200"]
index => "match-%{+dd.MM.YYYY}"
}
stdout {
codec => json_lines
}
}

If i have 20 columns which contain message
Your MCB Debit Card has been charged PKR xx 19 columns include this message
Your OTP login is 1 column include this message
what i want is that when message find the filter MCB Debit card in 19 columns it add single column card type and add debit against the 19 columns

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.