Hello! I am trying to split the message field into array and create many columns according to the list I got.. Can I do this?
logstash filter config is like below:
grok {
match => {
"message" => "%{GREEDYDATA:data}"
}
}
mutate {
split => ["data", ":::"]
}
translate {
dictionary => data
}
message looks like below
term:::asd:::session_id:::qwer123asd
So that I get 2 fields term and session_id