# Create fields by splitting a log

**URL:** <https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891>\
**Category:** Logstash\
**Created:** [March 3, 2020, 1:11pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891 "2020-03-03T13:11:30Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 4, 2020, 5:49pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891/5 "2020-03-04T17:49:44Z")

</div>

I would use dissect to parse the beginning of the line, something like [this](https://discuss.elastic.co/t/parsing-a-lot-of-different-syslogs-using-logstash/142324/2). Then use a json filter to parse the rest of the line.

---

_[View the full topic](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891)._