How can I split fields

Elastic Stack Logstash
1

Hello,

I have a field that looks like that
lists: list1 list2
The number of lists is not defined, here it's 2 but it can be 3 or 4

I'd like to create new fields with new values
lists1 => list1
lists2 => list2

Do you know how can I do that ?

The syslog message looks like this
IP.43.144.37: disconnected after 11 seconds. lists: blockliste spamliste
And I have a grok rule that retrieves "blockliste spamliste"

I would like to make statistics regarding spam lists: the spam list that bloc the most spam mails.

Regards

2

First of all I would suggest to split by " " using mutate.

For the second step, here's a topic over iteration:
Iteration in Logstash

3

Thank you for your answer, I will make some tests.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.