How can i parse the data with comma seperated in logstash

Elastic Stack Logstash
1

I have the below log format which is sending it to logstash through filebeat.
I would like to create fields from these and send it to kibana.

server1, cpu, 10, xinfo xyz wwer 2, xyzz
server2, mem, 25 , xyzinfo abc 12345 abinfo, 234info , abcd

basically i am looking for filter which can create fields by using comma separator.
The log file is not a csv format file, its a plain text file.
can someone please help

2

https://www.elastic.co/guide/en/logstash/6.4/plugins-filters-csv.html should be what you want.

3

thanks Warkolm,

i have tried like below.
if the file is not csv formatted, will the cvs filter works? please let me know
do i need to use grok after csv?

filter {

    if [type] == "log" and [log_type] == "winlog" {
            csv {
                    columns => [
                    "HostName",
                    "Metric",
                    "Usage"
                    ]
                    separator => ","
            }
  }

}

4

That should work fine, you won't need grok.

5

hope this example helps you,

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.