Extract value from Nested message field - LogStash Kibana Grok Mutate

You are splitting the message field using ",", but it is separated with "|". Try

mutate { split => { "message" => "|" } }
1 Like