Extract value from a multivalued field

trying a simple stuff with logstash but could not get the expected result...

I have a multivalued Field like:


and in want to convert to

Field_1: 3
Field_2: 4
Field_3: 6
Field_4: 8

I try

add_field => { 'Filed_1' => "%{PUB_WEIGHT}[1]"}


match => { "PUB_WEIGHT" => "%{GREEDYDATA:Field_1},.*%{GREEDYDATA:Field_2},.*%{GREEDYDATA:Field_3},.*%{GREEDYDATA:Field_4}" }

It's fixed always 4 entries, I try some grok expression but could found, not sure if I need to count the carriage return


You can use the Split plugin Documentation.


Great, Thank you for you quick help it's works now

That should be add_field => { 'Field_1' => "%{[PUB_WEIGHT][0]}"}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.