# Create fields by splitting a log
**URL:** https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891
**Category:** Logstash
**Created:** [March 3, 2020, 1:11pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891 "2020-03-03T13:11:30Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@prasadlele](https://discuss.elastic.co/u/prasadlele)
#### Post date: [March 3, 2020, 1:11pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/1 "2020-03-03T13:11:31Z")
Hi ,
I have configure logstash to read my log file which gives me below input. Now I want to split the message and create a field for each comma separated values against each. Tried to use mutate in my logstash.conf file however it did not work.
## Log snippet (This is a single line)
## werwerwer.com-1579808930169-13:1:1:1:634 03-Mar-2020 18:05:26,922 DEBUG [com.alu.cna.cloudmgmt.util.jms.JMSMessageHandler] (Message\_Handler\_Pool\_Thread\_1) message body: {"userName":null,"enterpriseName":null,"type":"DELETE","entityType":"alarm","entityVersion":null,"assoicatedEvent":true,"eventReceivedTime":1583238926914,"entities":[{"children":null,"parentType":"nsgateway","entityScope":"ENTERPRISE","embeddedMetadata":null,"lastUpdatedBy":"43f8868f-4bc1-472c-9d19-533dcfcb1ee0","lastUpdatedDate":1583238691000,"creationDate":1583238691000,"reason":"NSG:test NSG-C601-SIM(SystemID:216.87.90.41) - All configured NTP servers are unreachable.","description":"NSG:testNSG-C601-SIM(SystemID:216.87.90.41) - All configured NTP servers are unreachable.","acknowledged":false,"numberOfOccurances":1,"severity":"MAJOR","errorCondition":70002,"remedy":"Check the configured NTP servers.","owner":"43f8868f-4bc1-472c-9d19-533dcfcb1ee0","ID":"6b61d4ab-1eb0-4c4b-91d9-35b5437d87ac","parentID":"fe1b5d5d-3a7f-4e33-bbcb-81bfcf70f27a","externalID":null,"title":"No NTP Server Connection","timestamp":1583238691763,"targetObject":"nsgateway","alarmedObjectID":"fe1b5d5d-3a7f-4e33-bbcb-81bfcf70f27a","enterpriseID":"ff9dd969-5dd7-45e8-8afe-4f6215be462e"}],"diffMap":null,"associatedEntityType":null,"addedAssociations":null,"deletedAssociations":null,"ignoreDiffInMediationEvents":false,"updateMechanism":"DEFAULT","requestID":null,"sourceEnterpriseID":"ff9dd969-5dd7-45e8-8afe-4f6215be462e"}
cat /etc/logstash/conf.d/logstash.conf
input {
file {
path =\> "/opt/jmsclient/log/jmsclient.log"
}
}
filter {
mutate {
split =\> { "userName" =\> "," }
split =\> { "enterpriseName" =\> "," }
split =\> { "type" =\> "," }
split =\> { "entityType" =\> "," }
split =\> { "entityVersion" =\> "," }
split =\> { "assoicatedEvent" =\> "," }
split =\> { "eventReceivedTime" =\> "," }
split =\> { "entities" =\> "," }
split =\> { "parentType" =\> "," }
split =\> { "entityScope" =\> "," }
split =\> { "lastUpdatedBy" =\> "," }
split =\> { "lastUpdatedDate" =\> "," }
split =\> { "creationDate" =\> "," }
split =\> { "name" =\> "," }
split =\> { "reason" =\> "," }
split =\> { "description" =\> "," }
output {
elasticsearch {
hosts =\> "10.3.1.86"
}
}
---
### Author:  [@prasadlele](https://discuss.elastic.co/u/prasadlele)
#### Post date: [March 4, 2020, 2:05pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/2 "2020-03-04T14:05:46Z")
Can some one please help here?? I am in urgent need.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 4, 2020, 3:00pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/3 "2020-03-04T15:00:27Z")
Read [this](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and specifically the "Also be patient" part.
It's fine to answer on your own thread after 2 or 3 days (not including weekends) if you don't have an answer.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 4, 2020, 3:01pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/4 "2020-03-04T15:01:04Z")
Question moved to #logstash
Please format your code, logs or configuration files using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and not the citation button. It will make your post more readable.
Or use markdown style like:
````
```
CODE
```
````
This is the icon to use if you are not using markdown format:
There's a live preview panel for exactly this reasons.
Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.
Please update your post.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 4, 2020, 5:49pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/5 "2020-03-04T17:49:44Z")
I would use dissect to parse the beginning of the line, something like [this](https://discuss.elastic.co/t/parsing-a-lot-of-different-syslogs-using-logstash/142324/2). Then use a json filter to parse the rest of the line.
---
### Author:  [@prasadlele](https://discuss.elastic.co/u/prasadlele)
#### Post date: [March 5, 2020, 6:35am UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/6 "2020-03-05T06:35:33Z")
Thanks for your reply, Yes this was my first post over the discuss. I will try and be more sensible next time. Also will try out your suggestions.
---
### Author:  [@prasadlele](https://discuss.elastic.co/u/prasadlele)
#### Post date: [March 5, 2020, 6:36am UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/7 "2020-03-05T06:36:40Z")
Thanks @Badger I will try your suggestions too. However if you look at the message the second half is already in a JSON format. I tried to use JSON filter however it did not parse anything.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 5, 2020, 2:11pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/8 "2020-03-05T14:11:29Z")
A json filter will not trim off random text before or after JSON. You have to do that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 2, 2020, 2:11pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/9 "2020-04-02T14:11:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.