Get substrings from the log


Could you kindly help me to solve one little problem?

I have log strings look like as:

20160919;11:09:32;Username;E;Creating Report;ReportName;3;ReportNameAgain|11:09:32|1|02.07.2016|02.08.2016;;

I load them to logstash using csv and everything works fine.
But I need to get some substrings each in own field. I marked desireable substring bold.
Please see an example below:

20160919;11:09:32;Username;E;Creating Report;ReportName;3;ReportNameAgain|11:09:32|1|02.07.2016|02.08.2016;;

I'd like to get following result:

ReportNameAgain => Field named "ReportName"
11:09:32 => Field "Start time"
1 => Report status
02.07.2016 => BeginReport
02.08.2016 => EndReport

The difficulty is another delimiter "|"

I don't know how to work with it. I'm newbie in logstash, so I'd like to ask you to help me to solve this issue.

Thanks in advance.

You can use the csv filter a second time on the field with the "|" characters.

Hello and thank you for your reply.

Unfortunatelly I don't know how to point csv field as a source.

Here is my filter section example.

filter {

if [type] == "logerp"
columns => [
separator => ";"


If I understood correctly I need to use field named "ReportData" as a source for second csv section.

Could you give me advice how to implement this action?

Thanks in advance!

Set the csv filter's source option to the name of the field you want it to parse.

Thanks a lot for your advice. It works.