Field list

You can just run logstash from command line with --config.test_and_exit to check syntax.

If you are comfortable using docker containers on your own you can use this tool Web-UI for Logstash filter development

Either way you can test it and if it throws an error, paste here all the details:

  • log contents used as input
  • logstash configuration
  • errors, desired or unexpected output

In fact, if you paste here a sample log line it would be really useful. I presume that, instead of splitting a message in two by a word separator, splitting the result in two again by another word, splitting again by other separators... is a contrieved way to extract the desired information. Maybe grok or kv filters are a simpler solution for your use case.