# Filebeat and parsing

**URL:** <https://discuss.elastic.co/t/filebeat-and-parsing/90295>\
**Category:** Beats\
**Created:** [June 21, 2017, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-and-parsing/90295 "2017-06-21T13:06:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [June 21, 2017, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-and-parsing/90295/1 "2017-06-21T13:06:37Z")

</div>

Hi All,

I have text files in my windows machine ,so i have filebeat in to it to send me the data to logstash,and am receiving the data

my logstash conf look like this

input {  
beats {  
port =\> 5143  
tags =\> "files"  
}  
}

filter {  
if [tags] == "files" {  
kv {  
field\_split =\> " "  
value\_split =\> "="  
}  
}  
}

output {  
if ( "files" in [tags] ) {  
elasticsearch {  
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
index =\> "logstash\_files-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}  
}

but still when I see the kibana,fields are not splitted

message looks like this in kibana

q\_id="0001" user="xxx" registration\_date="xxx" log\_ts="00000" transaction\_code="xx" terminal\_name="" security\_center="34" task\_id="889" record\_type="6" log\_type="0" authenticated="0" application="" function="" used\_administrative\_id="0000000000" security\_administrative\_id="0000" registration\_date\_2="4444582" double\_log="0" security\_organisation="0000" TRANSAKTION="WW XX ZZ"

,but i want to separate fields

like q\_id 0001  
user xxx  
log\_ts 0000

Any help would really useful and much appreciated.

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![Oozza](https://avatars.discourse-cdn.com/v4/letter/o/76d3ee/32.png) [@Oozza](https://discuss.elastic.co/u/Oozza)\
**Post date:** [June 21, 2017, 1:42pm UTC](https://discuss.elastic.co/t/filebeat-and-parsing/90295/2 "2017-06-21T13:42:49Z")

</div>

Hi,  
Double check the `if` condition in the filter section. I think it should be `if "files" in [tags]`.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [June 23, 2017, 12:10pm UTC](https://discuss.elastic.co/t/filebeat-and-parsing/90295/3 "2017-06-23T12:10:53Z")

</div>

Thank you so much for the reply and it works.Could you please let me know if want to remove " this double quote in the field and value.What has to be done ?

FIELD is equal to DELSA="NR and value is 1235648978"

so I want it as

Field as DELSA=NR and value as 1235648978

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2017, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-and-parsing/90295/4 "2017-07-12T13:06:53Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.