[Filebeat] Range:%20990%0AX-SA-ID:%20778 to multiple fields

Elastic Stack Beats
#1

Hi,

May I know if there's a way to split the string into multiple fields?

Range:%20990%0AX-SA-ID:%20778

This is encoded. The decoded string is Range: 990\nX-SA-ID: 778
My goal is to split it into multiple field and the field name should be the key of each value. Such as.

{
"Range": 990,
"X-SA-ID":778
}

while urldecode processor, I got Range: 990\nX-SA-ID: 778.

Appreciate

#2

Hi!

I would suggest using script processor https://www.elastic.co/guide/en/beats/filebeat/master/processor-script.html and "manually" split the string.

C.