Determine when to stop capturing event and start another one

(Sahar Q) #1

Hi guys, say im sending an data to log stahs through http, the data is separated in commas and each line represent and single event (that i want it to be independent as a document)
Data for example:


i used csv filter like so :

csv {
columns => [
"ip address",
"physical address",
separator => ","

and i want each line to be represented as a document with this filter, but i dont quite get how do i seperate the events.

Edit: Problem solved.

Using Csv filter on a Split value
(Mark Walkom) #2

Is the | the delimiter int he http body?

(Sahar Q) #3

yes it is
Edit: Problem solved.

(Mark Walkom) #4

How did you solve it?

(Sahar Q) #5

I decided to use split{} and grok in order to get what i want.
the full input is recived via http and this is the config i used:

mutate {
remove_field => ["headers"]
split {
field => "message"
terminator => "|"
grok {
match => {"message" => ["%{IP:interface},%{IP:internet_address},%{MAC:physical_address},%{WORD:type}"]}


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.