# Determine when to stop capturing event and start another one

**URL:** <https://discuss.elastic.co/t/determine-when-to-stop-capturing-event-and-start-another-one/86078>\
**Category:** Logstash\
**Created:** [May 17, 2017, 10:13am UTC](https://discuss.elastic.co/t/determine-when-to-stop-capturing-event-and-start-another-one/86078 "2017-05-17T10:13:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)\
**Post date:** [May 17, 2017, 10:13am UTC](https://discuss.elastic.co/t/determine-when-to-stop-capturing-event-and-start-another-one/86078/1 "2017-05-17T10:13:53Z")

</div>

Hi guys, say im sending an data to log stahs through http, the data is separated in commas and each line represent and single event (that i want it to be independent as a document)  
Data for example:

> "192.168.0.1","255.255.255.245","01-00-5e-40-98-8f","static"|  
> "192.168.0.1","255.255.255.250","01-00-5e-7f-ff-fa","static"|  
> "192.168.0.1","255.255.255.255","ff-ff-ff-ff-ff-ff","static"|

i used csv filter like so :

> csv {  
> columns =\> [  
> "interface",  
> "ip address",  
> "physical address",  
> "type"  
> ]   
> separator =\> ","  
> }

and i want each line to be represented as a document with this filter, but i dont quite get how do i seperate the events.

**Edit: Problem solved.**

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 21, 2017, 12:00am UTC](https://discuss.elastic.co/t/determine-when-to-stop-capturing-event-and-start-another-one/86078/2 "2017-05-21T00:00:34Z")

</div>

Is the `|` the delimiter int he http body?

---

<div class="post-metadata">

**Author:** ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)\
**Post date:** [May 28, 2017, 12:44pm UTC](https://discuss.elastic.co/t/determine-when-to-stop-capturing-event-and-start-another-one/86078/3 "2017-05-28T12:44:44Z")

</div>

yes it is  
Edit: Problem solved.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 28, 2017, 8:47pm UTC](https://discuss.elastic.co/t/determine-when-to-stop-capturing-event-and-start-another-one/86078/4 "2017-05-28T20:47:46Z")

</div>

How did you solve it?

---

<div class="post-metadata">

**Author:** ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)\
**Post date:** [May 29, 2017, 8:07am UTC](https://discuss.elastic.co/t/determine-when-to-stop-capturing-event-and-start-another-one/86078/5 "2017-05-29T08:07:09Z")

</div>

I decided to use split{} and grok in order to get what i want.  
the full input is recived via http and this is the config i used:

> filter{  
> mutate {  
> remove\_field =\> ["headers"]  
> }   
> split {  
> field =\> "message"  
> terminator =\> "|"  
> }  
> grok {  
> match =\> {"message" =\> ["%{IP:interface},%{IP:internet\_address},%{MAC:physical\_address},%{WORD:type}"]}

> }   
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2017, 8:07am UTC](https://discuss.elastic.co/t/determine-when-to-stop-capturing-event-and-start-another-one/86078/6 "2017-06-26T08:07:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.