# Codec line delimiter by regex

**URL:** <https://discuss.elastic.co/t/codec-line-delimiter-by-regex/114809>\
**Category:** Logstash\
**Created:** [January 10, 2018, 8:16am UTC](https://discuss.elastic.co/t/codec-line-delimiter-by-regex/114809 "2018-01-10T08:16:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nofar](https://avatars.discourse-cdn.com/v4/letter/n/d9b06d/32.png) [@Nofar](https://discuss.elastic.co/u/Nofar)\
**Post date:** [January 10, 2018, 8:16am UTC](https://discuss.elastic.co/t/codec-line-delimiter-by-regex/114809/1 "2018-01-10T08:16:06Z")

</div>

Is it possible?

I need to create delimiter like this: \<9\> or \<13\>  
codec =\> line { delimiter =\> "\<\d+\>" }

It relate to this limiter as is, and expect to receive "\<\d+\>" string...

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 11, 2018, 11:28am UTC](https://discuss.elastic.co/t/codec-line-delimiter-by-regex/114809/2 "2018-01-11T11:28:21Z")

</div>

Sorry, not possible. The delimiter is used as a String literal.

---

<div class="post-metadata">

**Author:** ![Nofar](https://avatars.discourse-cdn.com/v4/letter/n/d9b06d/32.png) [@Nofar](https://discuss.elastic.co/u/Nofar)\
**Post date:** [January 15, 2018, 6:28am UTC](https://discuss.elastic.co/t/codec-line-delimiter-by-regex/114809/3 "2018-01-15T06:28:34Z")

</div>

Thank you.

Is there another way to get it?  
I tried to look at the multiline codec, it uses regex- but also seem not suitable because the way it cut the rows..

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 15, 2018, 9:55am UTC](https://discuss.elastic.co/t/codec-line-delimiter-by-regex/114809/4 "2018-01-15T09:55:02Z")

</div>

Not with codecs.

You should be able to do it with mutate gsub and then mutate split and then split.

```auto
input {
  generator { count => 1 message => "stop<9>wait for it<13>go go go - man" }
}

filter {
  # we can do this in one mutate filter block
  # because the gsub is done before the split in the code.
  mutate {
    gsub => ["[message]", "<\d+>", "^|^"]
    split => { "[message]" => "^|^" } # creates an array of strings in the [message] field]
  }
  split { field => "[message]" }
}

output { stdout { codec => rubydebug } }

```

Results

```auto
{
      "@version" => "1",
       "message" => "stop",
          "host" => "Elastics-MacBook-Pro.local",
      "sequence" => 0,
    "@timestamp" => 2018-01-15T09:47:39.736Z
}
{
      "@version" => "1",
       "message" => "wait for it",
          "host" => "Elastics-MacBook-Pro.local",
      "sequence" => 0,
    "@timestamp" => 2018-01-15T09:47:39.736Z
}
{
      "@version" => "1",
       "message" => "go go go - man",
          "host" => "Elastics-MacBook-Pro.local",
      "sequence" => 0,
    "@timestamp" => 2018-01-15T09:47:39.736Z
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2018, 9:56am UTC](https://discuss.elastic.co/t/codec-line-delimiter-by-regex/114809/5 "2018-02-12T09:56:49Z")

</div>

Closed on February 12, 2018, 9:56am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.