The "problem" is that you have multiple things that you want as a unique document in one message.
Either, if you're sure that in one message (that you want as a document) there is no space, then split it in multiple event (a ruby code might do the trick). If you have the possibilty, place a proper delimiter between messages (that you're sure that won't appear inside) and split on it.
thanks for the suggestion,
i've tried appending a delimiter and spliting with mutate like so
mutate {
split => {"message" => "|"}
}
and that is the result, i am not sure whats happening here:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.