Get substrings from the log

Elastic Stack Logstash
1

Hello.

Could you kindly help me to solve one little problem?

I have log strings look like as:

20160919;11:09:32;Username;E;Creating Report;ReportName;3;ReportNameAgain|11:09:32|1|02.07.2016|02.08.2016;;

I load them to logstash using csv and everything works fine.
But I need to get some substrings each in own field. I marked desireable substring bold.
Please see an example below:

20160919;11:09:32;Username;E;Creating Report;ReportName;3;ReportNameAgain|11:09:32|1|02.07.2016|02.08.2016;;

I'd like to get following result:

ReportNameAgain => Field named "ReportName"
11:09:32 => Field "Start time"
1 => Report status
02.07.2016 => BeginReport
02.08.2016 => EndReport

The difficulty is another delimiter "|"

I don't know how to work with it. I'm newbie in logstash, so I'd like to ask you to help me to solve this issue.

Thanks in advance.

2

You can use the csv filter a second time on the field with the "|" characters.

3

Hello and thank you for your reply.

Unfortunatelly I don't know how to point csv field as a source.

Here is my filter section example.

filter {

if [type] == "logerp"
{
csv
{
columns => [
"ReportDate","ReportTime","UserName","ErpMode","Action","ReportName","QueryType","ReportData","Field1","Field2"
]
separator => ";"
}
}

}

If I understood correctly I need to use field named "ReportData" as a source for second csv section.

Could you give me advice how to implement this action?

Thanks in advance!

4

Set the csv filter's source option to the name of the field you want it to parse.

5

Thanks a lot for your advice. It works.