# Elasticsearch analyzing and mapping data

**URL:** <https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601>\
**Category:** Elasticsearch\
**Created:** [July 25, 2020, 12:46pm UTC](https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601 "2020-07-25T12:46:49Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saber\_Ben\_Njima](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saber_ben_njima/32/65110_2.png) [@Saber\_Ben\_Njima](https://discuss.elastic.co/u/Saber_Ben_Njima)\
**Post date:** [July 25, 2020, 12:46pm UTC](https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601/1 "2020-07-25T12:46:49Z")

</div>

```
  {
    "_index" : "filebeat-7.7.0-2020.06.26",
    "_type" : "_doc",
    "_id" : "-cmj8HIBlEC9388KS7SY",
    "_score" : 1.0,
    "_source" : {
      "message" : "17-02-2020 11:45:55TO -> | Brand : TT | Channel : digitalise | user_id : 12902 | DirNum : 95350240 | identity ( idType : 2 idNumber : 08263539 ) | country : TN | Msisdn : 92393819 | IMSI : 892160208012526199 Status : 0 Out Code : La demande d''activation de la carte SIM 92393819 est enregistr�e avec succ�s"
    }

```

how can i analyze only the message field and transform it to fields , to this structure  
{Timestamp:  
Brand:  
Channel: }  
thanks a lot

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 26, 2020, 10:33pm UTC](https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601/2 "2020-07-26T22:33:30Z")

</div>

You can do that with an ingest pipeline, or Logstash.

---

<div class="post-metadata">

**Author:** ![Saber\_Ben\_Njima](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saber_ben_njima/32/65110_2.png) [@Saber\_Ben\_Njima](https://discuss.elastic.co/u/Saber_Ben_Njima)\
**Post date:** [July 27, 2020, 3:04pm UTC](https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601/3 "2020-07-27T15:04:53Z")

</div>

which method is more easy i tried this logstash filter but it's not useful ;  
filter {  
kv {  
field\_split =\> "|?"  
value\_split =\> ":"  
}  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 27, 2020, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601/4 "2020-07-27T15:06:53Z")

</div>

The time stamp is not n KV format so you need to use more than one filter. Start e.g. with a dissect filter to store the KV list in a field and then use the KV filter on that.

---

<div class="post-metadata">

**Author:** ![Saber\_Ben\_Njima](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saber_ben_njima/32/65110_2.png) [@Saber\_Ben\_Njima](https://discuss.elastic.co/u/Saber_Ben_Njima)\
**Post date:** [July 27, 2020, 3:15pm UTC](https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601/6 "2020-07-27T15:15:42Z")

</div>

so it sounds like this :  
filter {  
dissect { mapping =\> { "message" =\> "%{[@metadata][ts]}T%{}" } }  
date { match =\> ["[@metadata][ts]", "ISO8601" ] }  
kv {  
field\_split =\> "|?"  
value\_split =\> ":"  
}  
}  
don't hesitate to help me if you find something wrong

---

<div class="post-metadata">

**Author:** ![Saber\_Ben\_Njima](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saber_ben_njima/32/65110_2.png) [@Saber\_Ben\_Njima](https://discuss.elastic.co/u/Saber_Ben_Njima)\
**Post date:** [July 28, 2020, 11:20am UTC](https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601/7 "2020-07-28T11:20:29Z")

</div>

so it sounds like this :  
filter {  
dissect { mapping =\> { "message" =\> "%{[@metadata][ts]}T%{}" } }  
date { match =\> ["[@metadata][ts]", "ISO8601" ] }  
kv {  
field\_split =\> "|?"  
value\_split =\> ":"  
}  
}  
don't hesitate to help me if you find something wrong

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2020, 11:20am UTC](https://discuss.elastic.co/t/elasticsearch-analyzing-and-mapping-data/242601/8 "2020-08-25T11:20:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.