Grok for logstash

Hi All,

i have a log which contains the message as below
message ProName = 'Core:Worthiness:Price'

as of now i'm using the %{CISCO_REASON}= %{QS:proname} grok to extact it, but getting the whole Core:Worthiness:Price as the output, how can i separate each of them like Core:Worthiness:Price to Core,Worthiness,Price


If you want that string split into an array use a mutate+split filter.

Thank you will try it

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.